last executing test programs: 3m8.785777216s ago: executing program 3 (id=1082): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x141, 0x48, 0x13, 0x44, 0x20, 0x424, 0x7500, 0x69ee, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0xb8, 0x7, 0x2, 0x96, 0xd1, 0xca, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x200, 0xd, 0x0, 0x6}}, {{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x1, 0x10}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000900)={0x84, &(0x7f00000003c0)={0x0, 0x17, 0x4, "abe763a8"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000740)={0x44, &(0x7f0000000180)=ANY=[@ANYBLOB="601004000000cf"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000300)={0x1c, &(0x7f0000001480)=ANY=[@ANYBLOB="2001"], 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000200)={0x44, &(0x7f0000000ac0)=ANY=[@ANYRESOCT, @ANYRES8=r0, @ANYRES64=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000fc0)={0x84, &(0x7f0000000480)=ANY=[@ANYBLOB="201304000000f670e0001f5b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 3m8.252882546s ago: executing program 3 (id=1108): r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="01000000000000000010000000000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYBLOB="0000008001"], 0x48}, 0x1, 0x0, 0x0, 0x8040}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x1, 0x922, 0x0, {0x0, 0x2710}, {0x0, 0x2710}, {}, 0x1, @canfd={{}, 0x0, 0x0, 0x0, 0x0, "5c91440132bb112240fcbcc3fa9d0431575f8614d3538ce09c50eecd6ac579e8e83b944b666113f3afed71231e6653a13532f17b33515bdd7e1be14f53b9fc9b"}}, 0x80}, 0x1, 0x0, 0x400000000000000}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=ANY=[], 0x48}, 0x1, 0x0, 0x0, 0x801}, 0x4040004) 3m8.228770387s ago: executing program 3 (id=1110): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1000000003}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x2000000, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) 3m8.228313577s ago: executing program 3 (id=1111): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000840), 0x10403, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000003c0)=[@text32={0x20, 0x0}], 0x1, 0x6c, 0x0, 0x0) capset(0x0, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000008804"]) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)=0xffffffff) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_expedited', 0x369a02, 0x109) fsconfig$FSCONFIG_SET_PATH(r4, 0x3, &(0x7f00000023c0)='fscrypt:', &(0x7f0000002400)='./file0\x00', r4) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000600)={0x1, 0x0, @ioapic={0xdddd0000, 0x4, 0x8, 0x6f, 0x0, [{0x9, 0x2, 0x8, '\x00', 0xc}, {0xf9, 0xd, 0x4, '\x00', 0x4}, {0x9, 0x80, 0x2}, {0x3, 0xbf, 0x5, '\x00', 0x5}, {0x15, 0x35, 0xff, '\x00', 0x9b}, {0x0, 0xb, 0x7, '\x00', 0x9}, {0x9, 0x7, 0x4, '\x00', 0x8}, {0xa, 0x5, 0x3, '\x00', 0x7}, {0x9, 0x7c, 0xe, '\x00', 0x3}, {0x7, 0x1, 0x9, '\x00', 0xea}, {0x80, 0x2, 0x2, '\x00', 0x4}, {0x7, 0x21, 0x8, '\x00', 0xd3}, {0x4, 0x4, 0x36, '\x00', 0x9}, {0x6, 0x4, 0x5, '\x00', 0x5c}, {0x6, 0x9, 0x4, '\x00', 0x5}, {0xbe, 0x3d, 0x7f, '\x00', 0x7}, {0x8, 0x6, 0x10, '\x00', 0x1}, {0x3, 0x2, 0x0, '\x00', 0x9}, {0x9, 0x81, 0x7, '\x00', 0x5d}, {0x3, 0x5, 0x0, '\x00', 0x7}, {0x10, 0x3, 0x5, '\x00', 0xe6}, {0x3f, 0x1, 0x1, '\x00', 0x3}, {0x3, 0x5, 0x8, '\x00', 0x40}, {0x2, 0xb0, 0x5, '\x00', 0x5}]}}) ioctl$PPPIOCSCOMPRESS(r0, 0x4010744d) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) ioctl$FS_IOC_FSSETXATTR(r5, 0x401c5820, &(0x7f0000000080)={0x8}) link(&(0x7f0000000080)='.\x00', &(0x7f00000000c0)='./file0\x00') r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000540)) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r5) sendmsg$TIPC_CMD_GET_NODES(r5, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r7, 0x400, 0x70bd2a, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040080}, 0x10048000) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r6, 0x0) dup(r6) r8 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r8, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00'}) copy_file_range(r8, &(0x7f00000004c0)=0x6, r5, &(0x7f0000000500)=0x4, 0xa8, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r6}, @flat=@binder={0x73622a85, 0x118a, 0x3}, @flat=@weak_binder={0x77622a85, 0x10a, 0x3}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 3m8.227893677s ago: executing program 3 (id=1112): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000005500010000000000000000000700000012be230ae62fdc9e628d2df68505433ad1ab0cd820d1723735410abeddcf2be8057e90bbf36f062435984cfbc21e8cca66b2b038c35f1ab6fe0800000000000000c48adb18efad2fae7aa4c6e036"], 0x14}, 0x1, 0x0, 0x0, 0x4c504}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f00000002c0), r3) syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r3) sendmsg$NL802154_CMD_NEW_INTERFACE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB, @ANYRESOCT=r1, @ANYBLOB="29082dbd7040fedbdf251ee100000a0004007770616e330000000800012000"], 0x28}, 0x1, 0x0, 0x0, 0x20008000}, 0x40240c4) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0x27, &(0x7f0000000000)=0x8, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$SO_TIMESTAMP(r5, 0x1, 0x40, 0x0, &(0x7f0000000000)) sendmsg$AUDIT_USER_TTY(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="500000006404000225bd7000fedbdf255f6f76b5bd27a2146c8cef2c90008360ce5259b3650839e35172164d1304b6ba7cb005488faab3e382b47b3b9ccc8821a26973a9eea7e355b0ffa40ee5000000"], 0x50}, 0x1, 0x0, 0x0, 0x4000000}, 0x40801) ioprio_get$pid(0x2, r1) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) open_tree(0xffffffffffffffff, &(0x7f0000000340)='\x00', 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x7704, 0x0) 3m8.05200749s ago: executing program 3 (id=1117): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)="effd00001200192340834b80040d8c560a067f0258ff000000000002000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100050810000000000000040000", 0x58}], 0x1) 3m8.05184467s ago: executing program 32 (id=1117): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)="effd00001200192340834b80040d8c560a067f0258ff000000000002000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100050810000000000000040000", 0x58}], 0x1) 3m7.721638176s ago: executing program 4 (id=1122): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f0258ff2b0d00000002000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100050810000000000000040000", 0x58}], 0x1) 3m7.710756496s ago: executing program 4 (id=1123): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) (async) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000e, 0x4008032, 0xffffffffffffffff, 0xcdc2000) connect$netlink(0xffffffffffffffff, 0x0, 0x0) (async) r1 = socket$pppl2tp(0x18, 0x1, 0x1) (async) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) r3 = eventfd2(0x0, 0x800) ioctl$VHOST_SET_VRING_CALL(r2, 0x4008af21, &(0x7f0000000100)={0x1, r3}) (async) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000540)={'wg2\x00'}) (async) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x7624f2802272dfee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) 3m7.676541187s ago: executing program 4 (id=1124): r0 = socket(0x8000000010, 0x2, 0x0) write(r0, &(0x7f00000006c0)="fc0081001c000704ab5b2509b86803000aab087a0400000001481193210001c0f0030584050060100000000100039815fa2c53c2864800008d5e63efbe737f96705e670929f4af6002b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f74cec184406f90d435ef8b2941b94b661304fd5d60789b89d3ef3d99f30910a5bba2e177312e082bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae4f5df77bc4cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af8502943283f4bb102b21067693da9a9c2dbb8b8f5566791cf190201ded815b2ccd243f395ed94e0ad91", 0xfc) 3m7.622409979s ago: executing program 4 (id=1125): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXCEPTION_PAYLOAD(r1, 0x4068aea3, &(0x7f0000000500)={0xa4, 0x0, 0x1}) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000080)=@x86={0x7f, 0x3, 0xfd, 0x0, 0x7fffffff, 0x7e, 0xcb, 0x10, 0x7, 0x9, 0xb, 0x8, 0x0, 0x10003, 0x3f, 0xff, 0x4, 0x2, 0x12, '\x00', 0xb}) (async) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000040)=@arm64) (async) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) (async) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) 3m7.579542349s ago: executing program 4 (id=1126): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000840), 0x10403, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000003c0)=[@text32={0x20, 0x0}], 0x1, 0x6c, 0x0, 0x0) capset(0x0, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000008804"]) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)=0xffffffff) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_expedited', 0x369a02, 0x109) fsconfig$FSCONFIG_SET_PATH(r4, 0x3, &(0x7f00000023c0)='fscrypt:', &(0x7f0000002400)='./file0\x00', r4) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000600)={0x1, 0x0, @ioapic={0xdddd0000, 0x4, 0x8, 0x6f, 0x0, [{0x9, 0x2, 0x8, '\x00', 0xc}, {0xf9, 0xd, 0x4, '\x00', 0x4}, {0x9, 0x80, 0x2}, {0x3, 0xbf, 0x5, '\x00', 0x5}, {0x15, 0x35, 0xff, '\x00', 0x9b}, {0x0, 0xb, 0x7, '\x00', 0x9}, {0x9, 0x7, 0x4, '\x00', 0x8}, {0xa, 0x5, 0x3, '\x00', 0x7}, {0x9, 0x7c, 0xe, '\x00', 0x3}, {0x7, 0x1, 0x9, '\x00', 0xea}, {0x80, 0x2, 0x2, '\x00', 0x4}, {0x7, 0x21, 0x8, '\x00', 0xd3}, {0x4, 0x4, 0x36, '\x00', 0x9}, {0x6, 0x4, 0x5, '\x00', 0x5c}, {0x6, 0x9, 0x4, '\x00', 0x5}, {0xbe, 0x3d, 0x7f, '\x00', 0x7}, {0x8, 0x6, 0x10, '\x00', 0x1}, {0x3, 0x2, 0x0, '\x00', 0x9}, {0x9, 0x81, 0x7, '\x00', 0x5d}, {0x3, 0x5, 0x0, '\x00', 0x7}, {0x10, 0x3, 0x5, '\x00', 0xe6}, {0x3f, 0x1, 0x1, '\x00', 0x3}, {0x3, 0x5, 0x8, '\x00', 0x40}, {0x2, 0xb0, 0x5, '\x00', 0x5}]}}) ioctl$PPPIOCSCOMPRESS(r0, 0x4010744d) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) ioctl$FS_IOC_FSSETXATTR(r5, 0x401c5820, &(0x7f0000000080)={0x8}) link(&(0x7f0000000080)='.\x00', &(0x7f00000000c0)='./file0\x00') r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000540)) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r5) sendmsg$TIPC_CMD_GET_NODES(r5, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r7, 0x400, 0x70bd2a, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040080}, 0x10048000) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r6, 0x0) dup(r6) r8 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r8, 0x8933, &(0x7f0000000140)={'batadv_slave_1\x00'}) copy_file_range(r8, &(0x7f00000004c0)=0x6, r5, &(0x7f0000000500)=0x4, 0xa8, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000380)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000300)=[@reply_sg={0x40486312, {0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000180)={@fd={0x66642a85, 0x0, r6}, @flat=@binder={0x73622a85, 0x118a, 0x3}, @flat=@weak_binder={0x77622a85, 0x10a, 0x3}}, &(0x7f0000000000)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 3m7.457833162s ago: executing program 2 (id=1130): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000200), 0x249202, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000000c0)='/devFtR\xac\x13\x1e\x14e\x81h\xa3K\xd6\xd0^\xed\xd7\xb3\xac\xa0&&\xf8\x0f|\xe8\x15\xf2\x82\xb4\xa0\xc2\x01e\x1e\xf4\x19\x06\x03\xf5+\xc4\r\xa1\xb8DY-\x17\x0f\xf7\x8d\x7f\x9473\x1f\xc5!\xb2\x1bs\xfc\x91~c\xd1*en\xd1\xfc\t\x9c\xda\xfd\xde\xc0\xa2\xf4\x15\xf1\xd9\xe0\xe2\xf3^R\x8d\xae\x8d\x87Fc\a\xe6_\xd0V\'B?\x8b\xa6\x9cIT\x1f\x93\x8b\xfd\x814dX\x93\x89\x1a_45\x94y(\xb9\xaa\x91\xa5\xe8n\xe6\xb58.\xc4\ntJ\x11\f\xb8\x18\xfe\xb2\x93\x93\xe6\x82\\\xe8]fV\xc0#\x1c\xbf\xd1T\x809/\xc3\xa3\x17\xc4\x0e\xdby\xd6\xff\xfb\xbe\x83\xf7$\xf7\xc4\x16\xee\xa0Tn\t\x0f,|\r\xc3\xb39A\xc2wF\xb9l\'_\x89B\xf8z\xe6\xc13\x9d~\xd5\xc6\xae8\a\xa1\x90\f)M4J\xaf\x010;\xc7\xfd\xe7\x95\xfb\x95\xd6N\v\xf9\xe1=3\xe7\x8a\xc8\xca\xf12\x1aJ\xd6Xj4\x1a\x88\x04\xb1DJ\xce\x95\xdb\xd2\xab\xd6\xeb\xc6\xc6v\xd0#x@\x96\xbf\xa4E\x11\x9dH$+\xadS&\xa6\xcd>\xa2<\xe2\xa7\xa3\x99\n7c\xc5\xbb\xc2\xb9\xa3k\xaa\x9e\xe9\xb4\xd4\xbc\xda') r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$inet(0x2, 0xa, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, 0x0, 0x0) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2c, 0x0, 0x0) setsockopt$inet_group_source_req(r2, 0x0, 0x2c, &(0x7f0000000700)={0x2, {{0x2, 0x0, @loopback}}, {{0x2, 0x0, @loopback}}}, 0x108) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount$incfs(&(0x7f0000000580)='./file0\x00', &(0x7f0000000140)='./file0\x00', &(0x7f00000005c0), 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x9) r4 = openat$incfs(r3, &(0x7f00000001c0)='.pending_reads\x00', 0x101402, 0x130) ioctl$TIOCL_GETKMSGREDIRECT(r4, 0x40106726, &(0x7f00000000c0)) setsockopt$inet_opts(r2, 0x0, 0x200000000000c, &(0x7f0000000600)="ea00aa6600000000e28249cae008ec1aaafee8ad96e37d13340b6c8166f384aef14183c6b3362f2bec686363245f9ce55873b87f36ef903bbcdd9dee36c1221f75213f939e1ebaeb2bd72cc3b6ef28847b05e01604941f203ece9c1816885258be3fd388dc6aef4fa7796b7f019a7aa538127504fe78e47f26278be35b0d32afdb0cda25b3338a377f7053bf3665b69b82e38f61565114007b529828bda8bf4d865a2d1d9377f2ab29010aee2ba8e54677a80964de977a819af400"/202, 0xca) setsockopt$inet_opts(r2, 0x0, 0xd, 0x0, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r1, 0x10e, 0x8, &(0x7f0000000000)=0xffffffff, 0x4) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5}, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000002280)={'syzkaller0\x00'}) socket(0x8000000010, 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000380)=ANY=[@ANYBLOB="8fedcb5d07081196f37538e486dd6372ce22ff892f"], 0x3c) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYRES32=r5], 0x14}, 0x1, 0x6000000, 0x0, 0x44048440}, 0x4000001) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f00000003c0)='/dev/asjmem\x00\xa5\xea\x86\x1c\x80\x02d\x9a)\xbb|\xa6Udk,\xf8n\x974\xb5!\xb5\xc3\x90M\xabB6\x91>J,\xdb_\x82\xc6.\xe9R/\x86r\xec\xfa\xbc\x17e\x88g\xda\x9a\xac\xb7\xf0o\x16\x06\t\xdb\xc8\x85\xad,\xf5\xa6\xf7\x04\x9a\x8d\xee\b\x91\x14\x1c\xf6v\x02Q\xce1s\xaa\xea6\x14^\xc7Nh\xcdC\x93\xe6/\xdam\xe5/1\xd1\x83\xf4\b\xec\xa2\xa8\xdeQ\x16\xd8\t\r\n\x06\xe5\x91baY\x90\xbbr$\xa4\x95\xf0%\xba.\xe4\xd1WV\xd9Dz\x91\xad\xc6x\x1d>\xd4\xe3K@\xbc\xc2\xa3\x05\xf5\xab\xea\xef\x13_T\x92\x02FU)Q\xe1\xb9=\xb4z\x9f\xe6\n\x12\xc1\xde\xf8\x19\xc6\xbd\xc5f\x89l\xae\aU\xd6\xa4}\xb8\xe1Gu\x00cb\x85\x15\x06\xa8\xae\x94\xcfZ\"\xa5QI]x\x1fo\xc6/R\x90\xc4\xccn\x9e`\x91\xe9K\x18\x9d\xb4\b\xafO/vV\xd9\xf8') 3m7.336852624s ago: executing program 4 (id=1132): r0 = socket$inet_udplite(0x2, 0x2, 0x88) socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$inet(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x2, 0x4e23, @private=0xa010101}, 0x10, 0x0, 0x0, &(0x7f0000000540)=[@ip_retopts={{0x1c, 0x0, 0x7, {[@generic={0xe7, 0x9, "3d6cafdddae916"}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xcc}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @empty=0xfd000000, @multicast2}}}], 0x58}, 0x4850) 3m7.268097785s ago: executing program 2 (id=1136): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r0, &(0x7f0000000980)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x3, @loopback={0x4000000, 0x7ffffffe}, 0x3}, 0x1c, 0x0}}], 0x1, 0x20000001) 3m7.202425746s ago: executing program 2 (id=1138): r0 = socket(0x10, 0x803, 0x0) r1 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) keyctl$restrict_keyring(0xa, r1, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000000)='d\x00+\x88\xfe\xf7\x01') sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000000104010200000000000900000a0000050a000200000000ff05000000050001000100000008000340"], 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x4044844) r2 = socket$netlink(0x10, 0x3, 0x1) r3 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, r1) keyctl$link(0x8, r1, r3) sendmsg$netlink(r2, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000011000100"], 0x30}], 0x1}, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000009080)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000001580)=""/4096, 0x1000}, {&(0x7f0000000180)=""/190, 0xbe}, {&(0x7f0000000000)=""/62, 0x3e}, {&(0x7f0000000600)=""/101, 0x65}, {&(0x7f0000003580)=""/4094, 0xffe}], 0x5, 0x0, 0x63}, 0xffffdffe}], 0x400000000000343, 0x2, 0x0) 3m7.202106786s ago: executing program 2 (id=1140): creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) mount$9p_fd(0x0, &(0x7f0000000200)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000003c0), 0x0, &(0x7f0000002a80)=ANY=[@ANYBLOB='trans=fd,rfd,o=', @ANYBLOB]) 3m7.193140157s ago: executing program 2 (id=1141): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240), 0xc0802, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000840), 0x10403, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000003c0)=[@text32={0x20, 0x0}], 0x1, 0x6c, 0x0, 0x0) capset(0x0, &(0x7f0000000080)={0x6, 0x6, 0x2, 0x87, 0xffffffff, 0x40}) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000008804"]) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)=0xffffffff) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/rcu_expedited', 0x369a02, 0x109) fsconfig$FSCONFIG_SET_PATH(r4, 0x3, &(0x7f00000023c0)='fscrypt:', &(0x7f0000002400)='./file0\x00', r4) ioctl$KVM_SET_IRQCHIP(r4, 0x8208ae63, &(0x7f0000000600)={0x1, 0x0, @ioapic={0xdddd0000, 0x4, 0x8, 0x6f, 0x0, [{0x9, 0x2, 0x8, '\x00', 0xc}, {0xf9, 0xd, 0x4, '\x00', 0x4}, {0x9, 0x80, 0x2}, {0x3, 0xbf, 0x5, '\x00', 0x5}, {0x15, 0x35, 0xff, '\x00', 0x9b}, {0x0, 0xb, 0x7, '\x00', 0x9}, {0x9, 0x7, 0x4, '\x00', 0x8}, {0xa, 0x5, 0x3, '\x00', 0x7}, {0x9, 0x7c, 0xe, '\x00', 0x3}, {0x7, 0x1, 0x9, '\x00', 0xea}, {0x80, 0x2, 0x2, '\x00', 0x4}, {0x7, 0x21, 0x8, '\x00', 0xd3}, {0x4, 0x4, 0x36, '\x00', 0x9}, {0x6, 0x4, 0x5, '\x00', 0x5c}, {0x6, 0x9, 0x4, '\x00', 0x5}, {0xbe, 0x3d, 0x7f, '\x00', 0x7}, {0x8, 0x6, 0x10, '\x00', 0x1}, {0x3, 0x2, 0x0, '\x00', 0x9}, {0x9, 0x81, 0x7, '\x00', 0x5d}, {0x3, 0x5, 0x0, '\x00', 0x7}, {0x10, 0x3, 0x5, '\x00', 0xe6}, {0x3f, 0x1, 0x1, '\x00', 0x3}, {0x3, 0x5, 0x8, '\x00', 0x40}, {0x2, 0xb0, 0x5, '\x00', 0x5}]}}) ioctl$PPPIOCSCOMPRESS(r0, 0x4010744d) r5 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x51) ioctl$FS_IOC_FSSETXATTR(r5, 0x401c5820, &(0x7f0000000080)={0x8}) link(&(0x7f0000000080)='.\x00', &(0x7f00000000c0)='./file0\x00') r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000540)) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r5) sendmsg$TIPC_CMD_GET_NODES(r5, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, r7, 0x400, 0x70bd2a, 0x25dfdbfb, {}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040080}, 0x10048000) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x50, 0x0, &(0x7f0000000580)="de547e22bade76f1a03b79e954ee20bc43f7fe47218a02ff8ba942478a7b69462fc21aff55002ce55e854564e7d309f20d222f9220c8d9b1b0d196137252587ab17948adf2dcbba03d2f3e0e647c2e70"}) 3m6.252056775s ago: executing program 2 (id=1152): r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r0, 0x4004ae99, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000000)=""/188) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3314) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) readv(r1, &(0x7f0000000140)=[{&(0x7f0000001400)=""/4096, 0xfffffcd9}, {0x0, 0x2000}], 0x2) 2m52.311336162s ago: executing program 33 (id=1132): r0 = socket$inet_udplite(0x2, 0x2, 0x88) socketpair(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$inet(r0, &(0x7f0000000280)={&(0x7f0000000180)={0x2, 0x4e23, @private=0xa010101}, 0x10, 0x0, 0x0, &(0x7f0000000540)=[@ip_retopts={{0x1c, 0x0, 0x7, {[@generic={0xe7, 0x9, "3d6cafdddae916"}]}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xcc}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r2, @empty=0xfd000000, @multicast2}}}], 0x58}, 0x4850) 2m50.522626696s ago: executing program 34 (id=1152): r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r0, 0x4004ae99, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x3, &(0x7f0000007000/0x1000)=nil) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000000)=""/188) ioctl$SNAPSHOT_FREE(0xffffffffffffffff, 0x3314) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000000000), 0x167342, 0x0) readv(r1, &(0x7f0000000140)=[{&(0x7f0000001400)=""/4096, 0xfffffcd9}, {0x0, 0x2000}], 0x2) 1m33.76477688s ago: executing program 0 (id=2461): r0 = creat(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x182) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000000000018010040"]) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000080)=ANY=[@ANYBLOB="1500000065ffff018000000800395032303030"], 0x15) r4 = dup(r3) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2400c050}, 0x0) r5 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000440), 0x88000, 0x0) pidfd_send_signal(r5, 0x1e, &(0x7f0000000480)={0x8, 0x1, 0x436}, 0x0) r6 = open(&(0x7f0000000140)='./file0\x00', 0x20102, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="300000001d002100dfff0000000000000700000005000000000007000a0002"], 0x30}}, 0x0) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) mknodat$loop(r6, &(0x7f0000000180)='./file1\x00', 0x6000, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_COALESCE(r4, &(0x7f0000000440)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000600)=ANY=[@ANYBLOB="24000000f6d8f11d816b3c657209a11b85da677b15554cff93d84c4ee7ece630e53a3412364327ed589742c0839a2893d16ab5e1d79f1e1d0388dc27a6dea246e0a00f2642266dd6c5ecf80fd15df24a11d9e4ea2911258756e1006f7c8e1ab76d718cea5257f62b01c7a7f35ffab867a4d90b3b6b226aafc3ab0181cc1f137f7a14a1f99d86c1733da89fbf80a1c26365e84cc1c68179d9e125cf3b83de625f67962247da2fa55e49c592c7d2419e4cbba78bece825cc76a942070b7b6ce7027b4d0a31a351", @ANYRES16=r8, @ANYBLOB="00022dbd7000fddbdf2564000000080001004200000008000300", @ANYRES32=r9, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0xc040) write$FUSE_DIRENTPLUS(r4, &(0x7f0000000000)=ANY=[@ANYBLOB="38010000fe0000"], 0x138) mount$9p_fd(0x0, &(0x7f0000000500)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000003c0), 0x0, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@uname={'uname', 0x3d, '#-\xb1@\'['}}, {@ignoreqv}, {@cache_fscache}]}}) syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='mounts\x00') read$FUSE(r6, &(0x7f0000002640)={0x2020}, 0xfffffffffffffccf) 1m33.611589403s ago: executing program 0 (id=2463): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r0, &(0x7f0000000980)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x3, @loopback={0x0, 0x7ffffffe}, 0x3}, 0x1c, 0x0, 0xe0}}], 0x1, 0x20000001) 1m33.482479795s ago: executing program 0 (id=2464): sendto(0xffffffffffffffff, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000780)=""/227, 0xe3}, {&(0x7f0000001a40)=""/217, 0xd9}, {&(0x7f0000003500)=""/4096, 0x1000}, {&(0x7f0000001d80)=""/161, 0xa1}, {&(0x7f0000000680)=""/134, 0x86}, {&(0x7f0000002c40)=""/146, 0x92}, {&(0x7f0000002d00)=""/128, 0x80}, {&(0x7f0000000400)=""/270, 0x10e}, {0x0}], 0x9}, 0xf}, {{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}}], 0x7, 0x40000100, 0x0) 1m33.482320675s ago: executing program 0 (id=2465): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000002c80)={0xa, 0x14e24, 0x0, @rand_addr, 0xfffffffe}, 0x1c) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_QOS_MAP(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000600)=ANY=[@ANYBLOB="280000bcb99a663d560c49d664e75d004274e390a0f995f74ee7c53e63932a89e646db6cdb7bffd14cf67b617000314bffcf3a5064595133ead58bd3643fbab609c0f8f2a33828afed56db06bfd0866a4adc2f3fa9e8f50b01d77494a1db30366e449c2b6e57d9460d4ad5a2ee3c39498fdaa4a696e8fdfdcb95b20d09a94d6b086a3012649681cd6b67bb245ca925", @ANYRES16=r2, @ANYBLOB="010029bd7000fcdbdf256800000008000300", @ANYRES32=0x0, @ANYBLOB="0c00c7003a2ab59930a79579"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmmsg$inet6(r0, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000300)="5d8095954d00d01aa9d1c32ddf60cb5e46ebc4847109dc7e3f503a39b856a4e426bab18cfa8a34263dcba43d5ae4264c323ab6bac30a9d96e2262636856e33e3e18bc5df81", 0x45}], 0x1}}], 0x1, 0xc8000) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000200)={0x73622a85, 0x7cab6ced6415608, 0x3}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r3 = epoll_create(0x7) r4 = epoll_create1(0x0) r5 = epoll_create(0x7) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r1) sendmsg$TIPC_NL_LINK_GET(r0, &(0x7f0000000400)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000b80)=ANY=[@ANYBLOB="bc030000", @ANYRES16=r6, @ANYBLOB="200025bd7000fddbdf25080000000c00038008000200ee0300005400098008000200e4020000080002000700000008000200df09000008000100090000000800020042f70000080001001664f02b6cc6add903000000080002000100000008000200000000000800020008000000240003800800030003000000080002000900000008000200ffffff7f0800030009000000440002802c0003800800010004000000080001006e0400000800020000000080080002000100000008000100610000000800020007000000080002008000000004000400300004800900010073797a31000000000c00078008000300020000001300010062726f6164636173742d6c696e6b0000840106804600040067636d28616573290000000000000000000000000000000000000000000000001e000000d134018b05d04d82f4ff332c224626fe7fb665e0a442ea737b2975e1a2cd00000400050056000300c862e6d84bc893c6050cf47fc24b009c92d439be9b68419e2d335ad13cf7adcc945647d21f30f1388d2a5a38c43ce690afc094356f64f708cac3759372773d71eda85c418028375f790b64222e85fc2b4e5d00000400050004000200ca0003005af03d8bf76c81cadb8069bee1f61bbab8397d814ec5a53c6243437df73c8cdd4a7e457cf9f5f739138e83dece70617d3b3dbda3b12ce5edf75acb57ab5b6387ad490ad2fb07742fc7b4cdfd83e042002be7d04a7d367f812d157a0a836eca99894229d0f3bbd61b22c5bba6601aecfc9ee3b96f7f69d40dff78555ea37bf8d40ee105a8a12b57275e82d862a5bd010456ee2cc9d910321df1263eddb33d0d3ede85228939f182564c9d5aae77f2f4837cd5739e9a31e0bdd81aacd477a99d46f9010d8e901900000800010002000000780004800900010073797a31000000003c000780080001000d00000008000400010000000800030000100000080002000f00000008000400000000000001000000000000080001001200000014000780080001001400000008000400090000000900010073797a30000000000900010073797a310000000024000380080003000d00000008000300030000000800030005000000080002100700000090000280080002000b00000014000380080002000180000008000100db0000000800020005000000080002000104000024000380080001000200000008000200020000000800020002000000080001000600000008000100fbffffff24000380080001000800000008000200430e0000080002000400000008000100dea20000080002000500000008000100060000004cb74208f2a896f7307a6037f79eea9e4b46438dd73a4a6356953a751872342cc25189a395fc80b9cde5e9e71d285ed66d7711424cee8af4caf65c461a203a8573bf55171d66d9a552cc33b816bd4ba3d59aa0d85ecbe65777b53a3e622a58c33fb16298e5a899163051a83351df75571957dc75243613"], 0x3bc}}, 0x20000004) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f00000000c0)) prctl$PR_SET_PTRACER(0x59616d61, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x210749f, 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b100a, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000440)='./cgroup.cpu/syz0\x00', 0x1ff) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0) ioctl$PPPIOCSCOMPRESS(r7, 0x4010744d) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f0000000140)={0x60000000}) close_range(r3, r3, 0x0) 1m33.220693161s ago: executing program 0 (id=2473): sendto(0xffffffffffffffff, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000780)=""/227, 0xe3}, {&(0x7f0000001a40)=""/217, 0xd9}, {&(0x7f0000003500)=""/4096, 0x1000}, {&(0x7f0000001d80)=""/161, 0xa1}, {&(0x7f0000000680)=""/134, 0x86}, {&(0x7f0000002c40)=""/146, 0x92}, {&(0x7f0000002d00)=""/128, 0x80}, {&(0x7f0000000400)=""/270, 0x10e}, {0x0}], 0x9}, 0xf}, {{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}}], 0x7, 0x40000100, 0x0) 1m33.136806522s ago: executing program 0 (id=2475): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) unshare(0x22020600) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r2, &(0x7f0000000000)={0x2, @long={0x3, 0x1, {0xaaaaaaaaaaaa0302}}}, 0x11) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x0, &(0x7f00000006c0)={@ptr={0x70742a85, 0x2, 0x0, 0x0, 0x0, 0x15}, @flat=@binder={0x73622a85, 0x100, 0xfffffffffffffffc}, @flat=@weak_binder={0x77622a85, 0x0, 0x2}}, 0x0}, 0x400}], 0x0, 0x0, 0x0}) 1m33.036738074s ago: executing program 35 (id=2475): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) mmap$binder(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1, 0x11, r0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) unshare(0x22020600) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) connect$802154_dgram(r2, &(0x7f0000000000)={0x2, @long={0x3, 0x1, {0xaaaaaaaaaaaa0302}}}, 0x11) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f0000000000)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x58, 0x0, &(0x7f00000006c0)={@ptr={0x70742a85, 0x2, 0x0, 0x0, 0x0, 0x15}, @flat=@binder={0x73622a85, 0x100, 0xfffffffffffffffc}, @flat=@weak_binder={0x77622a85, 0x0, 0x2}}, 0x0}, 0x400}], 0x0, 0x0, 0x0}) 1m13.555602718s ago: executing program 5 (id=2706): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000780)=""/227, 0xe3}, {&(0x7f0000001a40)=""/217, 0xd9}, {&(0x7f0000003500)=""/4096, 0x1000}, {&(0x7f0000001d80)=""/161, 0xa1}, {&(0x7f0000000680)=""/134, 0x86}, {&(0x7f0000002c40)=""/146, 0x92}, {&(0x7f0000002d00)=""/128, 0x80}, {&(0x7f0000000400)=""/270, 0x10e}, {0x0}], 0x9}, 0xf}, {{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x8}], 0x6, 0x40000100, 0x0) 1m13.468027449s ago: executing program 5 (id=2708): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0xffffffbffffffffc) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000000)={0x6, 0x5, 0x4}) ioctl$KVM_CAP_X86_GUEST_MODE(r1, 0x4068aea3, &(0x7f0000000040)) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x141a82, 0x0) sendfile(r3, r3, 0x0, 0x4) ioctl$USBDEVFS_GETDRIVER(r3, 0x41045508, &(0x7f00000000c0)={0x6, "b7ee55bfade040001d1b62480504e542bcc298e6cbe8e8ddd1ae586ab7f31bee96900c3576b95a23ba32b115c41b8b001d58a3a00023f29b4d2d9905f25a55b611740272110accbc0c73de7340c17ff21b59e30353cd49057eaf6726f624a212c81a31c714000feaf4e29dde776a05c6039931d0f124cd217d19294d98af5b7b598aa4f9317071f7ce8961938a4dc6d84515a6c4a50cfa2f4d0d4c1b473185d701badcd16b7da0c8ef2f2d47d023e65d005096ad88e4fe4876bb4da1264883c96994c9448667174fe37cef02d9fb91aaec6255c84a69210376ba60c8a143378fcb96328226549455da288a8748758b48182c3d4109f142c29424c5ffd9e09dcf"}) 1m13.402405741s ago: executing program 5 (id=2709): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_async', 0x102, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x8) sendto$inet6(r1, 0x0, 0x0, 0x2200c859, 0x0, 0x0) fchown(r0, 0xee01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) sendfile(r5, r4, &(0x7f0000000040)=0xd, 0x8) ioctl$sock_SIOCETHTOOL(r3, 0x89f1, &(0x7f0000000340)={'sit0\x00', &(0x7f00000001c0)=@ethtool_cmd={0x10, 0x5, 0x0, 0x4, 0x7, 0x0, 0x7, 0xfc, 0x0, 0xfc, 0x0, 0x1ff, 0x2, 0xff, 0x0, 0x45, [0x0, 0x1]}}) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1380, 0x3}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r6, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r8, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r9, 0x0, r8, 0x0, 0x10000008ebc, 0x0) splice(r7, 0x0, r10, 0x0, 0x25a5, 0x0) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000940)={0x4c, 0x0, &(0x7f00000001c0)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f00000006c0)={@fd={0x66642a85, 0x0, r2}, @flat=@binder={0x73622a85, 0x100a, 0x3}, @flat=@weak_binder={0x77622a85, 0x0, 0x2}}, &(0x7f0000000180)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) 1m13.327298723s ago: executing program 5 (id=2711): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f00000002c0)=0x20) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x22) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='./file1\x00') syz_usb_control_io$hid(r0, &(0x7f0000001540)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="00220f"], 0x0}, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUCODE(r2, 0xc018480d, &(0x7f00000011c0)={0x803, 0x200, 0x6, 0x5, 0x590f, 0x2}) 1m12.742044704s ago: executing program 5 (id=2722): r0 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x60a00, 0x0) ioctl$BLKROGET(r0, 0x125e, &(0x7f0000000040)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder1\x00', 0x1002, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x1802, 0x0) r2 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2a, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x6, @mcast1={0xff, 0x7}, 0x2}}, {{0xa, 0x0, 0x0, @remote, 0xfffffffe}}}, 0x108) r3 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2a, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x9}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) setsockopt$inet6_group_source_req(r3, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0x40047705, 0x2) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x7, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="02142000110000000040000000000000030005000000000002000000ffffffff0000000000000000080012000000010000000000000000000600000000000027b20e97a6a9ecae000000ee00000000000000000000000000fc020000000000000000000000000000030006000000000002000000e000000100000000000000"], 0x88}}, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000040)={0x4000000, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="020f0000100000000000000000000000030005000000000002000000ffffffff0000000000000000080012000000010000000000000000000600000000000000400000000000000000000000000000000000000000000000fc020000000000000000000000000000030006000000000002000000e00000010000000000000000"], 0x80}}, 0x0) sendmsg$netlink(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000300)=ANY=[@ANYBLOB="20000000110001000000000000000000100000e60b00"], 0x20}], 0x1}, 0x0) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f00004e5000/0x400000)=nil) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) ioctl$KVM_SET_LAPIC(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000c40)={"e54c1421593cb4d3f8fe6094dc821bbbe06520701fc6de7b0349f34b0f8c556a9e9aff1355aab8d6da26d74608530f150f127f9e3f0a2f1fff0be9774ca3d6c007c91903f78616596487bf50017c56b15385ab264cba5b168c62d971e67e6f3e73d60b5a8adbaaf2af8610c6a91c0a116f619adce4aa91d5a68faf8ee98693d32d8d8244381b5720ef596600e39491d216c22d0725904bab7d90fa10aa300ef098609b4fa6dd77b1b7c321b1fc6356564ce3f90826be3a9a5be186ffc48eb13824e9dae77ed212a0f802074ff4f1725c4ad88cf5bbd36e3406bc59d96e82047631d8be9462ee7e54e5b2897c3fff38eabf67e1e160c2b5e18be06457844d89c9a606b7d25fbde713f4887906737c78821371dcca63540f113a2b5edc4b327d1f9610377b97265d4aa875b4bc3c44bf8110d5df1beb1fe54794a0aa52dfc80df1caf7d812b4f1cdba1a6836b45ea2180d08439d411ce8e0755868cc839eaeac73e5d28f9f1990584038cf5fa6bee0c4095a27cc8c7b59519bf2a9bf1fedf54cc2dc6aea6c42c32de40c291e5f422f5c7692a08926af160fb379576dd81bac746232fb246817fc3248097914b75e83cc5eb518ce8fb643b34cc79c3b61f0d94e7db62dd480198d41e0862f1ec4429ab637569884a5ba446a0b09edfd986a2b3e15ee35bbd18610dad6271681ed240bb700b9199b541013c0aadc36484da57511896c14776a41602aa1426edfbb828897d9c218b7936a0572840ebbc796e888a439b24e640324b511deb6ed0b2ce2f7567447826944b4f34101e492e8d20a2deda950e96e78f86d6d4c976f0c99041c94944309e6ce08d84a7c96677d570d9a57ec0506a4321d9e049b55be883cff7f000000000000aea5e6c2ded2ce72fb68989ae381fe1394cf6966ab04285d5ff8256bc2e85462b8d89aeeebd5432157c945b5dc1960d9282c6cc00794d4954f956c71bcdf846f41392ebe0d3b289438d24ec4bc073617459a6b232445dd636a9f21140e14b162fd5ef1d626b0ff84884fd63d22cc1b05befb77ea937f3045cc15b125479b262c1e32fca75a5468423288c5776efee744b1fccb5e6d661d9d287cfa8582c96ea34a33c1bbc29c0035657da66a87150bbb885be5ee123e431fd793ea979a0fc77aaee66d874c0616cb32324826b36d0e27d14217ad1131cace3bae4ef82dfbc790e78de53a9bfbdb468bf0eb3ff134073b380858965de2d108862daf3fc6b49ad46f20832238aeaa5d010cf08e37938f0bb7bbe8a970c39ce9327a16fe07565708266ce9ef639bfa08538693b456228aa1c370d64ef9795b7cc208a2c528d381a042d149ed5c7f34ed26a7d5a4401b86434f054389e5dac7a4ee896e406d7b27240d925d478e0eb2202797832d3e2c74f4925ad583779b97034f9400"}) close_range(r1, 0xffffffffffffffff, 0x0) 1m12.657255325s ago: executing program 5 (id=2723): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f0258ff000000e62c02000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100050810000000000000040000", 0x58}], 0x1) 1m12.637704245s ago: executing program 36 (id=2723): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560a067f0258ff000000e62c02000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100050810000000000000040000", 0x58}], 0x1) 3.426061244s ago: executing program 8 (id=3774): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000380)={0x2, 0x102000, 0x1}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000002340)={0x0, 0x0, @ioapic={0x2, 0x1ea5, 0x9, 0x2, 0x0, [{0x9, 0xf8, 0x3, '\x00', 0x61}, {0xa7, 0x6, 0x9, '\x00', 0x8}, {0x9a, 0xfd, 0x1, '\x00', 0x9}, {0x13, 0x7, 0x7, '\x00', 0xe1}, {0x6, 0xc0, 0x0, '\x00', 0x13}, {0x9, 0x9, 0x3, '\x00', 0x9}, {0x2, 0x8, 0x9, '\x00', 0x8}, {0x7, 0x60, 0x74, '\x00', 0x9}, {0x8, 0x1, 0x6, '\x00', 0x7}, {0x3, 0x9, 0xf, '\x00', 0x5}, {0xe, 0x2, 0xfa, '\x00', 0x3}, {0x8, 0x3, 0x4, '\x00', 0xd3}, {0xaf, 0x4, 0x10, '\x00', 0x4}, {0x3, 0x9, 0x8, '\x00', 0x9}, {0xd, 0xe, 0x3, '\x00', 0x81}, {0x58, 0x98, 0x4, '\x00', 0x89}, {0x5, 0x7, 0x3, '\x00', 0xc}, {0x7, 0x81, 0x34, '\x00', 0x1}, {0x86, 0x4, 0x10, '\x00', 0xba}, {0xa, 0x40, 0x5, '\x00', 0xf8}, {0xb5, 0x3, 0x40, '\x00', 0x9e}, {0x6, 0x0, 0x5}, {0xff, 0x80, 0x8, '\x00', 0x2}, {0x9, 0xc, 0xe, '\x00', 0x2}]}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.052640471s ago: executing program 8 (id=3778): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000780)=""/227, 0xe3}, {&(0x7f0000001a40)=""/217, 0xd9}, {&(0x7f0000003500)=""/4096, 0x1000}, {&(0x7f0000001d80)=""/161, 0xa1}, {&(0x7f0000000680)=""/134, 0x86}, {&(0x7f0000002c40)=""/146, 0x92}, {&(0x7f0000002d00)=""/128, 0x80}, {&(0x7f0000000400)=""/270, 0x10e}, {&(0x7f0000000140)=""/88, 0x58}], 0x9}, 0xf}, {{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x20, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}}], 0x7, 0x40000100, 0x0) 2.950517183s ago: executing program 8 (id=3780): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmmsg$inet6(r0, &(0x7f0000000980)=[{{&(0x7f0000000000)={0xa, 0x4e24, 0x3, @loopback={0x0, 0x7ffffffe}, 0x3}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0xc0fe}}], 0x1, 0x20000001) 2.08346024s ago: executing program 8 (id=3785): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_disconnect(r1) (async) r2 = syz_usb_connect(0x6, 0x4a, &(0x7f0000000080)=ANY=[], 0x0) syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0x4, &(0x7f0000000680)=ANY=[]) (async) close_range(r0, 0xffffffffffffffff, 0x0) 1.507843711s ago: executing program 1 (id=3789): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000780)=""/227, 0xe3}, {&(0x7f0000001a40)=""/217, 0xd9}, {&(0x7f0000001d80)=""/161, 0xa1}, {&(0x7f0000000680)=""/129, 0x81}, {&(0x7f0000002c40)=""/146, 0x92}, {&(0x7f0000002d00)=""/128, 0x80}, {&(0x7f0000000400)=""/270, 0x10e}, {&(0x7f0000000140)=""/88, 0x58}], 0x8}, 0xf}, {{0x0, 0x0, 0x0}, 0xd}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}}], 0x7, 0x40000100, 0x0) 1.485238981s ago: executing program 1 (id=3790): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000007040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000007000)={0x20, 0xffffffffffffffda, 0x2}, 0x0}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) capset(&(0x7f0000000080)={0x20080522}, &(0x7f0000000040)={0x1000, 0x10ffff, 0xfffffffd, 0x0, 0xfffff05b}) setsockopt$sock_int(r3, 0x1, 0xc, &(0x7f0000000000)=0x40, 0x4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) ioctl$KVM_RUN(r2, 0xae80, 0x0) setitimer(0x2, &(0x7f00000000c0)={{0x77359400}}, 0x0) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) r4 = socket$unix(0x1, 0x5, 0x0) bind$unix(r4, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r5 = socket(0xa, 0x5, 0x0) getsockopt$sock_timeval(r5, 0x1, 0x14, &(0x7f0000000100), &(0x7f0000000080)=0x93) listen(r4, 0x402) r6 = socket$unix(0x1, 0x5, 0x0) connect$unix(r6, &(0x7f0000000000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r7 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r7, &(0x7f0000002080)={0x2020}, 0x2020) setsockopt$inet6_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000080)='illinois\x00', 0x9) accept(r4, 0x0, 0x0) getitimer(0x1, &(0x7f0000000080)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x200, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r8, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x38}}, 0x2}, 0x1c) r9 = socket$inet6_icmp(0xa, 0x2, 0x3a) connect$inet6(r9, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @loopback, 0x106}, 0x1c) 894.392843ms ago: executing program 6 (id=3795): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000780)=""/227, 0xe3}, {&(0x7f0000001a40)=""/217, 0xd9}, {&(0x7f0000003500)=""/4096, 0x1000}, {&(0x7f0000001d80)=""/161, 0xa1}, {&(0x7f0000000680)=""/134, 0x86}, {&(0x7f0000002c40)=""/146, 0x92}, {&(0x7f0000002d00)=""/128, 0x80}, {&(0x7f0000000400)=""/270, 0x10e}], 0x8}, 0xf}, {{0x0, 0x2000, 0x0}, 0xa}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}}], 0x7, 0x40000100, 0x0) 894.094682ms ago: executing program 6 (id=3796): r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x1802, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000005000000014d564b00000000af"]) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 876.689393ms ago: executing program 6 (id=3797): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder1\x00', 0x1002, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220f000000540b4550182195e079000000000000"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGFIELDINFO(r1, 0xc038480a, &(0x7f0000000080)={0x1, 0x200, 0x10ac, 0x4, 0x7, 0x82, 0x4, 0x5, 0x1, 0x8, 0x7, 0x3ff, 0x1, 0x54}) 687.806047ms ago: executing program 7 (id=3801): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x8) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f00000000c0)={0x0, 0x2000}, 0x4) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) getsockopt$bt_hci(r2, 0x0, 0x3, &(0x7f0000000000)=""/248, &(0x7f0000000100)=0xf8) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$sock_buf(r3, 0x1, 0x19, 0x0, &(0x7f0000003080)) socket$inet6_udplite(0xa, 0x2, 0x88) r4 = openat$binfmt_register(0xffffff9c, &(0x7f0000000180), 0x1, 0x0) write$binfmt_register(r4, &(0x7f00000001c0)={0x3a, 'syz3', 0x3a, 'E', 0x3a, 0x5, 0x3a, '/^', 0x3a, ']$@K-^{', 0x3a, './file0'}, 0x30) recvmmsg(r2, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000780)=""/227, 0xe3}, {&(0x7f0000001a40)=""/217, 0xd9}, {&(0x7f0000003500)=""/4096, 0x1000}, {&(0x7f0000001d80)=""/161, 0xa1}, {&(0x7f0000000680)=""/134, 0x86}, {&(0x7f0000002c40)=""/146, 0x92}, {&(0x7f0000002d00)=""/128, 0x80}, {&(0x7f0000000400)=""/270, 0x10e}], 0x8}, 0xf}, {{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, 0x0}, 0xfffffffe}, {{0x0, 0x0, 0x0}, 0x8}, {{0x0, 0x0, 0x0}}], 0x7, 0x40000100, 0x0) 610.225638ms ago: executing program 7 (id=3802): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, &(0x7f0000000000)=0x2, &(0x7f0000000040)=0x2) setsockopt$inet6_IPV6_DSTOPTS(r0, 0x29, 0x3b, &(0x7f0000000080)={0xb3, 0x1e, '\x00', [@jumbo={0xc2, 0x4, 0x1000}, @generic={0x3, 0xed, "1a589bcc6cc134fff3bed4e1b9e60cef83c6f42ddff86c7d0d5fe7e3372e25ee83f6b203cde06d04dc630187aafc2fdc38339593b31264161cfec76e997b0c33600be07fa1ca5582d1ebf837adb75c92ff5584f2ca9bf3093da9814aa3f1bfe44b2e363e5e4500e585a7086c40c0fa3cb3d5415a0d0fb59ec8ba4f9735b7f2486613b0e71591ba8d0401caf75d92f5c93d12da05f56646d21980f63b9fa58e2017f94bd52473f0427e0b4f19b7b549f40079ca2c4cca9c59897b63a5faba8fdee5cdeb5385755711de9bf21391d9d2a726952dff6acd77107138bc84888b4be6d0cb21ac1a8914908372b43e7c"}]}, 0x100) r1 = socket$inet_icmp(0x2, 0x2, 0x1) fstat(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000200)={{{@in=@private=0xa010101, @in6=@loopback, 0x4e23, 0x61d, 0x7, 0x6, 0x2, 0x80, 0x0, 0x84, 0x0, r2}, {0xe, 0x0, 0xffffffffffff0001, 0x9, 0x7, 0x7, 0x5, 0x1}, {0x7, 0x80000001, 0x8, 0x55}, 0xfffffff8, 0x6e6bb6, 0x2, 0x0, 0x3, 0x2}, {{@in6=@loopback, 0x4d5}, 0x3499b1f761de1527, @in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x3500, 0x4, 0x3, 0xd, 0x53c036a1, 0xfffffffb, 0xd}}, 0xe8) r3 = open$dir(&(0x7f0000000300)='./file0\x00', 0x40a00, 0x10) mknodat(r3, &(0x7f0000000340)='./file0\x00', 0x1, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000380), 0x1, 0x0) getsockopt$WPAN_WANTLQI(r4, 0x0, 0x3, &(0x7f00000003c0), &(0x7f0000000400)=0x4) ioctl$KVM_CAP_HYPERV_ENFORCE_CPUID(r4, 0x4068aea3, &(0x7f0000000440)) ioctl$VHOST_VDPA_SET_CONFIG(r4, 0x4008af74, &(0x7f00000004c0)={0x8e, 0x28, "6947920194b3084d6005d72d0f9dc5ecbf7155855a3a1d961f5997329a5bedc72f70eafa6c137459"}) r5 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000500), 0x103000, 0x0) ioctl$TCSBRKP(r5, 0x5425, 0xa2) r6 = add_key$keyring(&(0x7f00000006c0), &(0x7f0000000700)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) add_key$user(&(0x7f0000000540), &(0x7f0000000580)={'syz', 0x2}, &(0x7f00000005c0)="b5d7f4f60bb26eee590a96cdc29dde33811d4e7d442ab71473d5da3c64ad91c2e75943e8206de292f675d87fa62dcf10d19a9042be43502d49f732e5ef1cffbf08c9385b65c95dff172e8ea6238104585e07775272405824eaeccd2e1c79ac8399676034eb60c692a8f92e48207ea7dcd7a62c7231f36f5ee38a72070595d2b2c41367fc89cc4e56715156af5d9c8c788eacba9c7d3b32cd37d232f19ca206bff4be60e8cfe0dea340a5a4efb68459493891d705d4f5b21a6adc3e0a6022b0ecd815e0a5031ee64f42cff5dce150e1151e51b7298e23ff34d61a2b7a331c1de8d64b0f75d40d6367d56938706ef8fa364ca165d85238eb7b93", 0xf9, r6) r7 = add_key$keyring(&(0x7f00000007c0), &(0x7f0000000800)={'syz', 0x1}, 0x0, 0x0, r6) add_key$keyring(&(0x7f0000000740), &(0x7f0000000780)={'syz', 0x0}, 0x0, 0x0, r7) syz_kvm_setup_cpu$x86(r5, r4, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000880)=[@textreal={0x8, &(0x7f0000000840)="66b9ec0900000f320faa11190f0199000066b9800000c00f326635002000000f300f01c33667e200baa10066ed260f300fc7984b48", 0x35}], 0x1, 0x34, &(0x7f00000008c0), 0x0) setsockopt$MRT_ADD_MFC_PROXY(r5, 0x0, 0xd2, &(0x7f0000000900)={@empty, @private=0xa010101, 0xffffffffffffffff, "be29ca0d17f85a7bf133ec8f64ede808fc8ac1fe77f4b0c2fbcd04cdc461383c", 0x3, 0xd, 0x2, 0x18b3}, 0x3c) setsockopt$inet6_IPV6_DSTOPTS(r5, 0x29, 0x3b, &(0x7f0000000940)={0x3a, 0x5, '\x00', [@enc_lim={0x4, 0x1, 0x3}, @ra={0x5, 0x2, 0x23}, @jumbo={0xc2, 0x4, 0x6}, @hao={0xc9, 0x10, @empty}, @padn={0x1, 0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}]}, 0x38) truncate(&(0x7f0000000980)='./file0/file0\x00', 0xe7) r8 = open$dir(&(0x7f00000009c0)='./file0/file0\x00', 0x0, 0x133) renameat2(r8, &(0x7f0000000a00)='./file0\x00', r4, &(0x7f0000000a40)='./file1\x00', 0x1) close(r3) ioctl$HIDIOCGREPORT(r4, 0x400c4807, &(0x7f0000000a80)={0x1, 0x1, 0x1ff}) keyctl$search(0xa, r7, &(0x7f0000000ac0)='trusted\x00', &(0x7f0000000b00)={'syz', 0x3}, r7) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f0000000b40)='ip6_vti0\x00') ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000c80)={0x10, 0x0, &(0x7f0000000b80)=[@dead_binder_done, @exit_looper], 0xa4, 0x0, &(0x7f0000000bc0)="b4074949b4f4d001a86365dfffc3d1737b038f56d029b9c42af757d01b1ad38a93d4121e8399b1b500ca0148be5e6ff87f303edf033f515c2c231d31388d6fb3dbcb1ac4a1f1dadf7a3c0b453032d06f96b67cf2139c45d583ce381d44cb9da173f16821189f51a1eda48a2cb6d7800c22642419177c2dda305bdba4a8e13c7f8f84e30313225951bad11154ee61a54f3f613eb194d5bd646450c86dbce4eeddedf85b1b"}) syz_genetlink_get_family_id$tipc2(&(0x7f0000000cc0), r5) 591.243989ms ago: executing program 8 (id=3803): r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) recvmmsg(r0, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000ec0)=""/246, 0xf6}, {&(0x7f0000000440)=""/183, 0xb7}, {&(0x7f0000002780)=""/4096, 0x1000}], 0x3}, 0x8}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, 0x0}, 0x1000}, {{0x0, 0x0, 0x0}, 0x7d08}, {{0x0, 0x0, 0x0}, 0x229}, {{0x0, 0x0, 0x0}, 0x7}, {{0x0, 0x0, 0x0}, 0x9}], 0x8, 0x40000020, 0x0) write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) r1 = gettid() r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) socket$netlink(0x10, 0x3, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x401) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x10) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text64={0x40, 0x0}], 0x1, 0x74, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x4c, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @NL80211_ATTR_BEACON_INTERVAL={0x8}]}, 0x4c}}, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r5, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') ioctl$KVM_RUN(r4, 0xae80, 0x0) timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = socket$inet(0x2, 0x2, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r7, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x4}, 0x38) setsockopt$sock_int(r6, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) shutdown(r6, 0x0) recvmmsg(r6, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) 558.141959ms ago: executing program 7 (id=3804): r0 = syz_open_dev$usbmon(&(0x7f0000000080), 0x38e, 0x20800) ioctl$MON_IOCX_GETX(r0, 0x4018920a, &(0x7f00000000c0)={0x0, &(0x7f0000000240)=""/71, 0x47}) r1 = openat$rnullb(0xffffffffffffff9c, &(0x7f0000001140), 0x180, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000004, 0x12, r1, 0x56a31000) r2 = fsopen(&(0x7f0000000040)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x4) r4 = openat$cgroup_ro(r3, &(0x7f0000001100)='cpu.stat\x00', 0x5000000, 0x0) readv(r4, &(0x7f00000012c0)=[{&(0x7f0000000100)=""/4096, 0x1000}], 0x1) ioctl$BLKROSET(r1, 0x125d, &(0x7f0000000040)=0x9) 458.520081ms ago: executing program 7 (id=3805): r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x1802, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="0100000005000000014d564b00000000af"]) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 434.763532ms ago: executing program 1 (id=3806): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) socket(0x10, 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB]) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, 0x0}], 0x1, 0x49, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 300.488544ms ago: executing program 6 (id=3807): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x1000000003}) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0xa1ff, 0x0}) 266.393825ms ago: executing program 1 (id=3808): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@userxattr}]}) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='mounts\x00') read$FUSE(r0, &(0x7f00000042c0)={0x2020}, 0x2020) 198.664446ms ago: executing program 6 (id=3809): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB]) close_range(r0, 0xffffffffffffffff, 0x0) 198.493896ms ago: executing program 1 (id=3810): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)="580000001200192340834b80040d8c560a067f0258ff000000000002000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005387fff5dd00000010000100050810000000000000040000", 0x58}], 0x1) 189.274906ms ago: executing program 6 (id=3811): r0 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000), 0x20340, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r1, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r1, &(0x7f0000000340)='\x00', 0x1, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000000), 0xffffffffffffff94, 0x12, 0x0, 0x12) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) r2 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000240)={0x0, 0x0}) r4 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xfffffffffffffff5]}, 0x8, 0x80000) readv(r4, &(0x7f0000000180)=[{&(0x7f00000001c0)=""/262, 0x106}], 0x1) syz_clone3(&(0x7f00000002c0)={0x1000, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0), {0x2b}, &(0x7f0000000100)=""/247, 0xf7, &(0x7f0000000200)=""/5, &(0x7f0000000280)=[r2, r3], 0x2, {r4}}, 0x58) ptrace(0x10, r2) getpgid(r2) r5 = gettid() wait4(r5, 0x0, 0x2, 0x0) ioctl$ASHMEM_SET_NAME(r0, 0x41007701, 0x0) 129.883227ms ago: executing program 1 (id=3812): capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x9}) r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, 0x0, 0x0) r1 = getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) open(&(0x7f0000000080)='./file1\x00', 0x10b942, 0x1) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000380)={0x50, 0x0, 0x0, {0x7, 0x27, 0x1, 0x801001a, 0x66d, 0x0, 0x0, 0x400, 0x0, 0x0, 0x40, 0x9}}, 0x50) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000008280)="03680f2a20da68ab7a58c28b635d19c32b6efabb6ae3b5eee5a74d8943c613539e166c8baef50500824343a2f05093a5c21f746caefe9f9bccd83cca0fc28da20e2706308c61398dfce5f54ea9f266791ba29a4c7da158637def8b816aa296815ff13c06d632df45feaec1fd272ec1b510eaf58fe6b26cc36df3ecc0f5b1f258a190304e2519dd39ba9f5bc1788926ced5202e3b1e3afa16ae0b5d66dc05b36d3a00f72e5f318f8bdfc7eddc94238c50031d0657a22445ad0b3b90a86b086eed837a00bf0a3888bf61b4db57d6d8d6b286bbb13ba3b246def60ac34241eb843f89fe77d7e3e52573e90d791f21d4a8dfcc24ba95db60e2135634c02bd4b14535285df4fbe381ec036d876c4c8057c79371fa9717414590890e182a7b9e0ab927812083acf0d04e04c20c0555c8ceedc5bcf9b0e814be6eca98ce7b2f9f17d098bea541b75a1617c09fa99902ad746811f89a1fc5e6a80d77528247d6c104395715d2c9f9102f070a295f20c4307b9e848d3928b50985bfa2486893139761925b8fab96d26291243db23c4fd4d96864f4db860731a4e3e10b52d8d0487f5a8536cb4507dbdc111570ad0321b918edbc52807c2e0676d3257553702d9c1bd6741e9cd5cdeb3b8f636b6eb02a3b0066d7f677d586de5018850000f000ab3960f6656fb98039ceb6400d0299c356fc22b7298ed157c667bed5563fac2192a8ff7706a9e58d9d2f92632d6b25d8b090642e3f323bf7ff4d8264617a43a97099dd7347fbe3b1c439737913f17eff57f3e1ff4fdac374fb554e9a6a1ff32daa69507698d660d8d5f591801d8e4a9309342c3dc84966dbfcd2652800200bcb0dde9d456b7a07c5409f4f5387d0150daa34dbc865c6108d34dcc51eedb277e9638b43ce3c9afac5d7aa0f8542e58b0a84632a07557b041845d0012cf016ef065f97660b731ce1b79493de71def047277a3ae6d4a0d86591847d3475926039848c5baf6e1b43bc83053855182423156e54cadc8c85089265b49da853d15e5a701fedf2bf7986a723abf72e513fa05cb178345f2fcc859df49e74c8ccef196000a05cb090f22986ffb6f8f74ab41d2d88b6b535507a23b03d2fc2743f6f69fbcd43b8ff52b1ba32fa0137d542c515569b7f486f8ffa02ad1f54767f51701eb4c141437720884d529a57e17bc2837799124f7f112f42bd90f5b435d7a5d7524f7667bb7a6266263e62bf7ebf6896888d584c65a530b766111f078630d8629ffa91acb5ed02498549bd7e042acae0fab7ccb23278088a364be3da9619d91e1061bbaa9b33c3c5fbbcbc040d3ca79d3ca056c360381ee87e743dea73a25ea2b4843f9ef280feb507f933fb556c718d8bf8f8618db72805b65d381b319f65c745c1e5060dae2f498852e79aff8dd9c88fd939a31871a430d3ba96fb118c79d1b08a397af23b1a188d1802106f588c768a1e6c9d244ac9a38d2a54ed50f19b78bf25e0ae1f9337ceaa8ff5ca8640104b19bcd643b51501d4e03ed5ffb383e7ed0ab78d540ae10bbd64fba1af59a4190215b7d10230992bbb4ff618d8284a2e2446990511fc2bff07cce9ba94a11d3db041e220e3d931fdf129d8ec2c9b17d6587a0044c9e09f52848db43ddc0df94513cc9e94e9d427623502a910deea0f21d86b16366769a46bf0d6d9fc0d2cd6b98ed885e9e2d765bdd051196bf20bd27c46ec902726d96de352c346d904fa00d63b67d272f116dce489f9d636cef61b441b9c113addec983b8b2fbdb2b32049e436c972b2fcf5140dc7b094c5047cb6226da700b72aeb3febdf16a75b6f61a311f606251c99b377c775c8fb3446ccf25dc4cca24290b3939f948019b05c80b5a6382112f63e0990b324c16a087c72aaec08796afc769f678e3634100a5a9da8215cb5d7a6a6b50a81676ef4edca35595b11f9606bef2fb84fe1f0a0703c886579f09986086f0dca6eb8061f9a74c79c1f758684a7363974b14561b9d2efdaba6c4cd8cb70627da1e195fcae3d8b2fa751278e8f220c83e677e14731eccd6fe0c357b011ed88b6df0c266b383f224b8e95384e401b717030b1227582d0d1042bd90377c4f2c7206a19983fc5905e4eb87edb6532b26ca9e28e160202606d19d9f5da34762f4b3fa842d7bff382ad70dcbc411f8b3e4cace8c8e0c72898d24023545e0dfdc4176209276a535491ce11c045c57b45c40f19b12dcf6ffbf78ab23e7fe9bdc404cf47db9855f2b835e1fce57debfa071803ec38da3c77a904080a4c737ce2b20e14e8449762f1ca0b1ce71779d2e6ee5299e1cf230e8070045c23c1d0e52f66fe9039f95cdc0b448dc12d24de39157934270345991948fce921b5d8e739315cc75d4b3b49928437b88672c1a7770365207b43895f45909d5d972f48aa66de609152a5afa2c7d75f0a14189d0409f0b623eab3b6e7d81025cde140893ed71b6f24f5a36d21dafb62af6be9da845403bc8ed36672efa74d7da19d5794cb4b79fa1c86940b1890c012e14b7c3bb261f16bdd99efaa9819b0bc00af842a6b94c6086d15b16ab81af9331ba3a5bd6941ef35239e85455ceab02c598ccee8fbad97ed37daebfe3b26a5a6c9eda5f65a1cfaf7a1f1688267c812a56c552ae11b465dac030e18f9008ad03cad80bf2cb91a7d99dcfa54d323ae0a4c3a6dc0f80d7ff703870610a945eb0ab5b6d14e81869c8872f6b123d98edcf6bba10d76d35cff4b0bb73db8b6695a8351785bcba1e160a42ed367c4da727da38f91562e941e5c4fa90cd585c5f1cd3a7d6892f18a5aa3c74a4fc00bf5909267489b937a928d9d8ff92530b5226eedf8ab9a957e5ffec45bc3a55e6955b38393ce52892655265d1f741e0b744808eb568a08d145a8bc5ada9b079f6d0bec5fc2ace0502b3f926372dff49478fbd10451f0de4b3d1a63b9d4e17ade45628d2e9dca041fcf7fc1e105e1fc44089fde9caf418ba8454dc361df4a59e1bd79143d280613e3c79ad18e922a43e199aa5927bb9553dd31e6223ad19bf8aff6e1dac8b3680feea3138bc61742b03f047b3d77039c1a4c2d05bd89c4bc12a1b83d78b4e7023f690fce6a44608c423d8cbc2e80942b9d9df2f4bf5606640fa47692f3e003885983a73e1dc313b243bbab5c3c6348afab796da766044ba142eda5a9d3713e3eda8c54c1708909c5da89ba67d29cd7f409c9b759cba316c42028754e3cb6eae2cc4f6d66982f212320f199b2e837bb4c54c54bcdcd2ac240ef6295d38e9889b4213819ef0f9aba6ceead4e0fd2c4becdc1f8ee3049831996c9a74a5fd4e12a1fd21ed47cf27e29f9d61e4b673d88914c36eefa53d3c49d94b463b7f8462c1951dfe33c10993d5cfcd0ededd50ad55009528f1e79fbc2fa70c3338b32c40ae3bb45d7079c7ae8433fb1aa19affbd3fbce0cb5ab0d557afb3be036856066eea45c28e93528b35477fc97fe9ff3641e5bb0f0e46069eb653c027daabff38541250081c77e0e3a1d030a73289e771cc41db10819af60599b5df0ad978fcf0b46af821c6b717b265e07d3a85397ea94de26f510290ddb5df8fcff76fe624843c8577802809c145916afce01d9dfdfa8bf07633e98f14fc73d5ef58ae5cb0c308bc74ca38259692a1cd4cf16752786a1c816f24612c27393d7e40a2df9a3dfa23a0c59613c8a7ccdd97c3fc67ecab94dcd8cc4b4517ed2414d41ce574074ffebd156e3d65c4421b0f339bc9f29abbfe49db62122248cf96b74d9639b3ef9d935cd81315a7ecfb0dc6ea1ee053c2e5c3615fbc10782f16a564fcabe1df70da7de989e00eedc346cef5b5cf880e9d563fc15302f056d37f98a939fd1dd5478b4318c256e93b77e31f87d8f7fe31755191b40d778ddb2ada1480bb9fcb96a09783f13cd460ee2c9cf4a712f04eb1b1a746091109f7ce0655e1ff7781fbe853e3d03bb91c9d8f4f416f5745c6b607bbf72786bd3c0ac4761e6e6d70f12dbefa1b13542086f793b72c6102ac06e75be17bdbb1efbf7e007f07f9bd433fd9d9cbf93e760757b792f15231895561fe49d9d683ccc066f38af581422b71702627162c0f0f35c36a61eaaa92129114b7334281e35fd39576e51d8593c149c9326e0c710ea4dcc9ef39a432a48ae1834f5046b954f9c033d6035cde0dbffe3e97f48a1dc695f4b2f6fe5d4eee83008318def105c37e11c9015670f13417ed036e68f6fbfca2a8289829677feb23079f3f2ee53b26e491924fefc1c50e54f288a8c4b6ba6d319054c3a9e39e14bba81b423acbd44b51279bbea6b0bb2047325837ce8b2191454f52ffa2cd04abe89e3de5bc102e9fdf740d3efd975bc9503af796e6aeee711ef8797de5d507a964730aa70cb9d3840054d4e1ffc57de378b511f7649666a54a6b3d91ed517198d76322bf99d13bef530a43ed3f13196bf2def6dcfb39f76471c75c5779bedf105717e546057fb478bfd24e8fdf3c12d028b542d1f424a9d45bb9e026e6098eb1cb0a77378300ec1b4c9f006aa4dfb7fb5c57cf1b035cbe96009ead1ca25ea1e5fae40312a4e9fe250684a1c8653bb303209e0fc6a498f3a08f6c5b946378a349f3aea45104a2badb8a45f500bb4f0f6cd620ce794e0f390e1cb7f2f1fc0039f4250a577544a6862b47bf89eea3a8c1516b7a9dd111c2ca719190e8feb1a7079e9fdfdb8224dc50791c986825469c087c8f081616edaa4193e161281aa68b7286a364cbb336b2459f0892e57c40afcfda7d16ea1877efb4e4b0d4b5c31e8cba15066903d3a91bdc7fb64452fb9843436110596f0b038da167a86f97d32c807270a1c994fe88e2517e11bdd210dd982d3c8158459440108308a936c9d2370b9d157c3f9caec36ff05bc40b37f095edf33bf4fad440f38c3f52129456936c07014140be5618f4e9d07b66679238023390cd676b1a3a28d0e90d5ad9ef13a31fcdc5a435454309367c437424e340a1f91c6483bce1026d85a16fb854252ea4ede39a4e69702ecff76432de508e064eda0df9f263a25c0f626d1c1ffaa6783be2975451ee936cc2178648935a924f6fb2db2f8ba34e348920d903114520918cc6872b842e3744fc18d1363583a107ec7b89c7792c0d8069e12f873f6d668f6fdeb47b72986914e45c2b061c5c936c73c9bcf1475ea0d25edaad21cf193405c8acef3bff4e4f1b2b321d70dba59e856a8849c2bba9508bad775370669b2bb7f5e53181af8bff525e13a4935d7e28b997b4ff15da9e36f1353a154ab701ad15420786daaf27ba7e122f7b825c668185b685630420378b4142ec4e4242c2cf0bf6e143f7e55cb12fb9dd59a8df9959ce4fc5fff68ae7174977a31ad7fd644bc94a20bae76f0af474034990fdfec8ceca0e6cd93fe21d84837b7e9d74c17b6d3054f0c008ee05764745fd8773a0c1c31bb3eef5b7e261b54805b5c805a4eeef05c812fcdede200442e7340c63490645ebd09c235d5c52a785542526edfe3875ad08267faed1d0a15236f00c6736b94c1a3821302ff610697ad7becdbc96f54b55138b585cd122e0d5aeaf43c9ba373e8aa1c1297e3415552cc57cd60ee1f3c04500ed0eed37775c873de3066c034c176c67c5bfbe9899a47732030855781341374641da058eee61d01d11b9db8f19fd4558957897340e32cdfbc39713f1f439be0638f614cdb5361433a45a6ff024e39c94141dc5403af101404ce5f2efa97b90d9ecdb7c361785dab977feded32554d1a74d5cbfe2435be7f0329ba382455c2ac11fbe29fe3826796d4bea03dc53a37f63f5be2773f83faf282f0ae24d9fe5762b71b499fd37b4ce7e71f93c3a983f80fed477708bbf2261c89893c4b76e34fac9b42671b6cc81678cc867f53e8c3ec47716206212743ca0c4941c2c61ed3177fccf85921e998d2b826df751173944bb07eeaae4001f677a0687a2550eeac8bb5128ecad9c7b6a514596a30b8292fbacc09ab488193507b6785d7a35c979db774b2c413246f1ae88d35d1914b20b8fb501034321642fb0b0baba3378e4c31fb5e247c177e573295df0194462b99079a436400ba1be2e30d39b8714c0fb2bdcd981d5a5cd514f8d4f14e4e0437108630355d8f2b60a6d18cb14ceb2b5d0704aa6e93e180bd79cb17e176bc4f81a03db12a03413de6189896955bb9e3cc69b6f9a50a7eda3742527f98c71d7ea8ba75e253c2b783f7104813c619949e6a0765179b1b9cbe68b703335ab5986928d86384357a2f4189f4b4ffcd61a3d29709bbc93b5371f0e7798cb72ae4c17bcee24f8e566f2777803c3d182d15a63ac40063f0ccdf4bd790404524eae02eafb6b54c699578486490033f0be866c74a134083003d330498658ba973ea674c4a0ff158403987b4c4752b07c8637a119b019fd5093406960144445056f6ffe73eda0235dc1871bb6058d4a9feecac628265689d58a81453d33290ab56eb691f3180d0288449f41844e56f5c6cf522d4a5866b24fb9552fde71946c4d25dcceaa41cfddb5a33c51c54c0a0a5abd31be8fb6ec53c1d14ba648e183979dbd0db01b9e51ba3803be7e7d3dee752668367264c783f74838121797ae5706ef3aa460682d1bf55808c70e69ae29d7683368470d08e7e9a1095305dce250b5b4bd48c02e098d241b1089736e8306a737e3a1a93e554cc3ab24672b8c74bfb8825004ca869e347f873de14575493836662ad741d79269904f905d7df64d0581ab8d76ee51a32d72ccb719f3a25c0a856b5bd2b2a1269e208d70c32e1d5ad0dfdc0ef43f0230e95eb85871eb4d6033abbf0be7025382d878eeaeea73c94270e79bd5757dc1bac95236a62545cd467830b12dcc30d7cc81e889d360d073db40058e9a1c7b41fc53e67740bc984132a1452cf7d000378f14ef93a7eb0dc9bacf23584ad6761139576607f8214757f71fc47b2944127116ca3e83b9d9643bce8d7bb44b4d16b5d5cff70a9e1114cd920b6fc1f409672648ad56ac3136ef0a314adb458faf3d3f171cb2fc513d76e43e6bda2f1a68e6fcf4a4ecbe6bc87716e2a82ea0c4657983ca0caaf8d75fdf5b0d7930e4f3e95eb1271485f938e7ad2bf0c97b7c11745de45518a1e3a74341968588558e7197b407d24eda0671ee28f219e4c5f809a7ea6f9f5b9705f4634a96112eb262bd5967db5237285b865d3f64516495ea6d1ec20dbed7af02362370bcc98671a61241fa1ef5b3095609d66ecc16010f6f67a280d1c6d215ec224ead17d68bbc9bc64b363b5be9b479b7aa2cbc8587a6b48cf653fde7a262a11ab3a10356f55f122310feac77c32ce0994d6e8a70f1c53331cb473a8e29427322fb6da292c4443b1678877f1c981fa05fbdef96520e5895aeb2a3a8e62652f9d8830c3b144b9598873e2ef41b7ade943807766877d609972cca74855eaedce07cda35b50557de96e736ca3107c154d31aeee78db234687b9964517bcd2c6c9ec047514b45c831aee4588166dc3ec9ab36bd1033e74b3d02d731c5bd84f659fa9fe55cac08c12cb999a2e64fac52f6cb7d1fffbf45d9a1126787d0060fd1be563ccbc278ac97dab0c1bee664675f273f5fa429bdc24b21ff1cf0a3ad3c687fb07ffd88bad6ab6c6b422a43b77ff76f96bf405c07f8a667bb8ff54d6714aaa21ceba2e78ce03146b2ab9f49e6d65081119b8e7cf3843e91349790d2b975c9f9c305df0ab4f2b1b2f30f629313cc66a325e4037f38f29842ee5781ba73d2f30f506cf7ff2237a72b4075aefa32cdd5ba0ae4e65cb6fa47a3e06f0d5f684b7172d6b58f5f7d783c4122db4f4b8b4f9d3296c9d115f432710c29d40dfca0010ecbe2f42fac899911d65c84f08aaa1923c8add5af518286211db14e1187a8839f3b2ae8bd914eafc16a576bbe3eba6271a4c5b3170c3f543761f11f1326a05c575bde1b5c6afd3876bea4fbb649071a95caf74de9f7b3421803ec351f934b8d0932ce72a13abf3627d9a396c10875fc167ef1ae98ff92af9ca366033c99d30306fd540a09d67d26ab192504e7c09f9e4d06287a2b1748f1761ba3c16d9d08be7562b7351c4b4679f5d4b38681bfd86c7f2003a9749b20b602112a95803469f5d252c564912b55c4bf3409298dbd066d877cc70a89b484b9ee6bb836c9acd1e53086c4be85e9a3bc5969c7016db9c72b68620c241409d06f4d7f72fe2289c9b4921055922783b8b886bc22926b7d194820af2b90e3c60e87e1a7851f38a970c07c1da120d1da75de2bb994ff7d05a313522373326f160914a9589711e0439d694f5221afe8cc118722ce4927e9543e61a12a76bcf2da1d01a0f258095d32063387349b4e9f253d8b73c6e834b6866f8a56b4797b92d521fa732aa0d55c8e9d6c56011ee6fb450853dc564d18e97c463609c27a63f9c91c46d7bd80ace4edc0615ca342f43ca3b3d0cc36ed52b7d1f457e5b4b26b5eca0d91abe4f1a42a2eec40ec2faff1222f71dc226d6344e947b45155691205c09913fc3c6ab3fe76f4d1b11fa45869e20694b5f0a1074780a07332764212533b797dd24d8df157d4172f91253b77eb2ec90c8222307ed59136463057b7f469116086410b7503b44cef401c47811c1390060da5b3321d34096b67468a7702978d98d4bd721c18a25ed541249638e90281dc8e3565dc33e66d7b832a9bd62c02c5ed0e92935c92472499653d2d842ea6697c733ee80d775884074b3a0c250a4aa021bb6ea93514f9cc5f09feb5719d270cd184e364ca966f1416e10f111bc425f32a993fc5cd75503f99d89d91d7ddc6dee70193057cb946e5fbf8663c53e12cebffe5dbd4a86bfcf5f35f0d8aa43763a60e00356b4f8bc2bca01b02cfddde38f0c4df1e7f98709fdebc5abb5eb9631bdc3dbfcf15517fabcf16931eb7381e83713b081ad1947274d4896ee8953d772e9e71f363b6f1147317bc739ec128e4ec865f8f0ea34cd5ff19fb2c28931d2c85846735358504ae9161535cd7890e8b95c814cfec116b78e6d0eb5097cd4f35888121452e27391d865c15f0b986925d0d0c623bcbb4d8ca66603720253af17853967ea5954eb5ef0dc43de185ec4925026c680464e66d1caff1f4c7c757bd55ec2515ffe7183e3481ff6f626c2228a3fc3d15f63e4bfbec76a2a170206142cbbcf204a1cbfe0ee56eb47dfb79c80894c0a0fbf8a2955d861678fc2f8f9ad7a28052197b5992bced1273658da5b1f42fca48c80883600c24d8515a0c7113deb4c97df918ab64bca16a0c14f2547dc91d5ce4f884978c95fe54899f77ffc20a2c4b27350bc451bef72a46d8e144ad57a8d5f8ac039f58b8a53ea1f3fd5fce612a171bf82ba17c0681cf46ce5c8181a522ed2e986361903903159643046c7be1787dac6ccab09d18a30997541dc6e9efa260f1ff0392bc1890f19d8bb725f4fe7d8bc618f46e0c23be6b9ca67777dd3f5a89b41ccfb11a526a3bed045a2906f86cc5186a1db7a70391261b694b423e5a44d374f9d3720330e083574083f8950b2b35c8bb5b6c0a7fe259f235dc1c069d4581a9f0a7451890561a0829bb290de6aefe4d243ae0b00ca61a1dc4262bb4951242b21d88148eb7b6a9718d6433274f2b3c9bcdbb6d5df67b48ff42692d8cd7f4b7f41728de68ea1ce0f3e4a2843c5b9ffc43f69b8a0445dce44081f5b443a327084b0d00d07cbdbbfd2da5d67bf8d4bb4ee408d17eeee48b61decd06bd3dac9a1adbeb069b49ec96608b9179bb3af4c10f2ade6778b31fd4c22c2961cb949a64e9a8a4879c550f8d8783064cb304511e40e2e562ba83c08ba8ae011a784ed9db03db5527a5aae222c856c8df0a94f9c4def0f94244c5b8e3db9f39dbd337928e24d9d8562f231fea72116c01089163d2c5f4ca17faab20b73c9957fa1a9af20837a804870034d4e64281125b070d8ee0dbf05f95e5fb079e2a57e9af977222e90b664189114dccbca81ee58b7de90a813768a2049052b339a608d3e9966bdb3b584291fbf7694a7d1dea7f72ca604894e6cca5d326ed5e48c15eff5e6a8cc11c40f84ca920d79a5c55d07001909bf6338921c656a39d59d03f62bb5b8870189f0416ec8c317b03ccdcbbeb3e1a9bf2661813f4966b57eb56a2757de5f7745851b5f7bf75e41eb1646e61a41923c5c0e58c2ea478d95b5c39c450744aea0aad3706fce684cb7338ff3dacab60e8d968f0e6fc070693ae3ca16996b34a50afb7e6e377546ae28dc8de7a2ea3a657b4b0003a91a488e347c61971d62f32eaf843d4d4c4f86cc4033c1244c8408def09188dde509c629323f34072f9089a3846680894e8b000a03865438b2ea212b68fdef7f17583f92014eef2c8115a37c9c82dee06213c1407c1433690f68cdc8e91971104039dfe06774b946f43b68b7957a5ca3ee763eafbb7437850eb0a285c413bcf6965232d593d8da47a2a06abc635ae38e596a9dae55b43f341bcc6fe72d79b453ac1c259da37f64cbc1f1508caf280aa6a3f4cd2ff5564cc5a8727f222431454a5ac93398a29fb95b4e057686cd6fcd920992f74e5870749676a36e043bec5fc1b0fce5563affe9addfaa3689e857383ccd1f2924080449d2cfb006e855570b711c1dedd1df2629afaa3806f4ae229a9a8ef1940ddf2c55dac7812d2374c0684b7ba27b2f0849ee4c055d2b8ccc8e41c593378340d7546bb974bc8032f220b37099e3b04c6591c40d2c50a855a491e03c1c9cbb32c400f6104341262d92daaf3e2c04936cf28788fdff8e0a77770a9deb9089a9e32eb5d9e2581aecd98f83881ca8e7d49e603556dc03a9aa19a8f3a4735aaee347b25ea35b36fa57484c0b6d591979b4a3da894fa0c15966d6a5e02e397cccdb9c314b504372b81ef6913877767001263c05dae362b49e5928ef36f554ce245b4111486417634f1e7f4530a760ae6ffd3123f5736ac12c5bf506c5dca03079c0fd0776cdb56c938cdf480fb9b97b1685dfa3be6f712aae107e2dda726bec137b2ebdf56c0fcaecca4350bd7b5c84d57f29c2a2c99ae10c30cece4831d71ae4ee3362983cc816bb6cb9225b9db08503a1be23a26a0425a8628a2e718feae5df91d829f27966f766b623a0a4958a57642aefae259713733670d5b1d027fb8eb2d0d3a0b4acd482076dfa09ffe883f556b2db2262bc0872e1bd713f100dd7a8a8f2d725b46e09c625d513179872bbcc9a41e596a18b2471d977f4ca2bebd06cdaba31b70ef25e098f214fef16f16f725cad4311eb91457fdb70b471eddb65ecafb1e2b03c5ff21356241e3cab2c8ba601f9ef1aec9006b7cd0b81da29be01cb4c1d52e563298e373013886ebb1889bd5616647c6c418ea6bc1f3c0853b65cae48467b35f08318e3a9d034af7224cc3520ab1ece7751ba15407298b21e4f84ef7c23d7993739403d4f116cba2d0ae2d4003a28334c461c734d4555105b986ad0af28aac36c753ab52b91b7e23ae3ab07d3b170fe53a2249efe5b65463a3f237cec72091b04005f95a15ae595191ba39d0ae1d91d8e00b132ae9339884bc57bbb79978a308e1c31c5f213b092f380a7ba58f55869e9c29a5a6e7a7aa4f8d58e5787cc05e500", 0x2000, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f000000a280)="1695367704d10dd832678e4e2d01860484a69eaac410e2d6cf3b3d3925f9a3cb602592377170dffdc4de86f163e390e21d07459b0f058cfc248c4bcbe896f3c68006f3c2cbe07c55b87170871c1d364d740faeb750c8c8acb76aca18bc0c018ed341b55b0ef80cefe95b85756aac978a0e0b5ce59cae6657643e7ada0c1336bab310888351664553c2faa6dd39054e19e23cc7c4b4d33546407f880194aa0761f2a9360c4ba26de342328b92db81ae84fc9c1e9eefb4b7ec3f58a6d5d23b907327b14480a37f3c84305729a91c28807f8809b997235bfa2d4b6f45ee9568bb4a416df34f4140c5e272bfc068ea61a48b365490ccb02772a906dad457f5d2dd1a57cc1209e8897c8115049d7e4e3c756a7f5ad0c004ef66c8bf91f600910e73b4aa5f516bab5cd62ad93642960ab32b7fdaeacb1a9587a389a529c231f8a47a65fb6d27ba6a0eeb46660cd75dbf47df89e9f578eafa6992a12d9d7de56d69fd0e30b15caabd13c28d63921597466292f8c4e87f23d53d52e6e8f1c9295af0743c8c671a49273074ba44dbce9e9b1136a93dbc19d2b8e60cda5f50eba2d814822a68a0fd4ff5e6a25dd5346f96b26b5e1563ebb97829a76fd8c2aa467499fdced91b05b193b68316494f11f5ce97ed8e13d474b03c6f6eda4eff54b0ec362fda53003e6e2a3868a5d57e2426aed5adccdac8e162c6cc20361dd4709889b79b2810ba42f531fdd3746562a00da65b4211fb7d8f482a3610748d3b80d2942d8432471f98c6e9036cb57f3913b31dd8baddd6d85b44e8463b838fcfb6979628c5fa3dbd30688e10b9ede257ebc7b96d4092f38d11b9e6a4d10490a9df1387b3743cf51e206c7dbc0741c408bbebaae7f36d81b5ce5b21bb9fe992c8a0cb3a91ea2df21e571ff094b53b17c46fe22c0cead29144d203294eb42c984790a6b6348ed8b7b0317ee5b2353cc54bcfd808bf0f61f73917584e17bd9259c8a04d2ba3b4f931571947c77035975933471fb1203088dce478eb4e411ddb7b88caeb02e1cda741245df701a2b5c29c48a631eaf18549bd90c70222fd6dafe5550726bb58dd0fbf84ffeeae683a0379505f03740a652025add8e0e4e6b5bfb4bd0876dfe1ecb639acc110eba97294a4e4642aefbcad04ba50d830e945fd9900ee7e02488694041f43cbaa86280c1df64e8f1f81f7cd5130914efd19b58262f3bd2c43bd8b4a5beac09f1ba27020521994465e62c329debb50efe0716d22cf0056febc7cb95aa818e10639077e91cac3c80b37d6eebc6907dde971b578383ee04086a0dad18750ceff6b8d6d373afa93a51fee65fe1318c1ac291b784e45d66962c8b54571bc1e92a996c11561d94af6ecdd37948d35adbd1ad63c1c05c31c7f4afd707aa1956d1444fec1137fb6d81f56566887131777e5fe3e2fafe8af8f21ed34480afe74afb25d8d16f8089fcb851ac49dd826b7f273aa3d771856d712c62397d49c72d93e3c2a5e6b9767fcff0fc5b3d70dcd70ff8bad5dfd7f5a84c194f99450601f970104f9be026852ead21824152dd8f6536fcd01a69177a65f2af266e619d61d20de0c738680fbec29e7c594cad29f009d46d87908c951b2e4ad8d9a67db8be6f570fe5416d9e4dd22a108140a1c95369731807325ee7f4201209a795fa1609ce8fa27384677816f651a96cc08400e1b647bdddfb851313e3ccaa472b9a6a1da3a0936e119a6d7808f09de244d739c39df3ed36004b77cb54b6b1396b718c87fba28cb1439c7d1d140dae1ee2c2a7d647427b1e7472710c7ac4f1fb0fc0c9d15ecce28167d23e2e42474dbf1c63c0819606be9c9b6dc2eb59bf9932568ef408c20e9498cf105e84eee30460d4348f4cdfab623b416adadb4427887d9b1b6b8db75b224e8a55fa0351d21093b2b7e42e6685491cbfce100d602d0281f4bd086b50612f3ccf055fab1aad97a52695a233c3d458be4536b66b0acdda5ce0aaab48bb7d7f39a8af473c4478991f1c4569839eab0c1d684001ee1772290871653a2293bb7754c1eac178c60f86e2a98e1992dee198c76365f2d04d159d7c210c6cc58764e3b7dfb5bc15190555febd01c69cab8f55926c28a13fa4f9060dde1ca2df7e1f71fd99a0c350d7f0e341ece8e0685e9c205b486ef400910211b688f07fb05b542261c74b45f4ac23ff53e9e620ab12dad7b5131f67128bb8ed6a4a70caec437f2157f8bcb3d080091e5715dfc7d7539dd0320c90d0aab6a6d7a447ebeea893a0efa2176292c648c62cedd4138c9d0535ab0621855484fc43e0e3e84357db6951bb21fe2f4e99fa188ebecbc23f73ea879bd304408acd1c470fd112606ccfd7b7970e950ebd363afbba359a51877248a42845097094ff785dc82264225752f3aefa980d9ed5309b48f47a5b5ef49f69808b91bde955277b6525f55436ffeba0bfa8c13f6314c57ec97eea295afc66a9f4ec844474c0da6ff1ef0c6c65c035f3bb74a70ffa668359b58a46af97600c428626b45c81a4e372e198894c02e2bee8010fb4c2c075ea623a6ee24a99e225f809322df6ea6f39b1566b1aee5403d45ba648f94f70976013199b3241744458d030a5319360780897413289d89267c389e04f23de79adf4b864c5ca76efc225eb1ecf6424887f0d8b3ac13cbe9df4eb69f7b702e85fb396dc4a030d57a8c4edd227ee568fb11a9859935ad53dcfdb01727f106af352c569a020b7e405a1ad4c6b39e2e8796fe9f16db3794550f5ef3ecd6af2b2ab0383e6c198f17ada5840bde84ccbaa661d9c456d9ddaf92763ba450098cd5a971d847fd5030a4c9b066ab3b0096dfdf7e5ce2f8349165f94c493b7e4192e85239bb11552f910fb41c5e96ee10fc8dce711e88e0572ce0bbbd9c9f3b7c9dae89f1dfa6af309c4321755a5b19070c8731ac590c30fffb69feeb75f699aebb101d3a30f784f1745182cb4f0bf63a148b521f0a03c691927694ee453b278523e3ed256c150098a932f62c90ac65faa4b9782c27a3ef6ca2b5ecae6a01d8a1d7096bf6a7d1b317a9eab22ef4907c631bcca224f723f5fb9a44d7e1295186cf37fd71343919aa167fa70a505a73e9f52a11cfbd40d8c1087d4ffdfe45a40ed5aebfa4b0c3622c78a914d68dd92f46478711437ff88803ab28cd9ce2223aa0fa37eb9d9a4a7866dec4ca6bb66e794ccac6bd19b11daa0b6d4d42cbcf7d6426b5718030ca51bf92b3d8ea0b11c46ec5c0c6e3805c88b39731b2b751d9928ed1ddba7c66bcc5273d709fd295aa0792384435b98c1f44575c028ff2869074156713931f7e62f8b0f8c7ee9dfeaeb2e096e77600586a47d6f6a2e13a17dfceae46ad84858bf8873f9f1e35fc700aef0a648af168ab0774a3441a203ef325577f2c76f5f0e5808acdc7965bc65e8ad1ca816bc3b67711ea42e619c957d0f26b394be1f3b0c4ac9af8558eaebf5c1c27b6549022513479b4c28dbe3f1c3131cc9211eee768f96a9c8b5e0e6425bef921a355faccf0072ba19b16d88b75feb5dc8fcfc1b7b5973eb9654ca3dcfd482831ff5d1fe09fe7ae43cf129c8c17a6686685a13ed076f34608b7ac16eb8e9de6a44418c4e3f8162e6a679bc9482df96a04b14575ebf093b99bf5cc26495f5dd6e571129d9760de3f801b001a1f3248d14f579bc519de2b656641a88da758a2ed3baf15fdf2739ddb44f0e5892de7ea48e9302129d0c939137b9d0687b296577675bcbf433a53f6a9816797cbfef1ba0caa2b8602387b5a8bae24d3e15d42b34d81708738fd269c3e8cbacdc3ff5ab1d4816a783d7be0f0a8086e345a6b4c231ffd61745f6c45cfceaf6089e70542aea1574e3c78740f77a08eb55b37f03549c1dd318cb5a76094210e8cf800c350d328fbf9442d0437e7affd54b3bfc33da3f24558f3ea8e59da8e61ae60e7e7b4de7179b8cf941d51d420c8eee69143966800dc4f7bcb50a033331fcac02a65e88de28ab219c68388a9da9196e044dd1ebbd3994bf8cc862f6f8b419fa1f4f4e5427f10866b498935fa28b8e6f9c5e48be8b74b9c2262823390480f71aff6cf72281f526265877d223eef9ad7a4be7438f9afb6aff0e80c5125c2c612ceb83f0470ea04479979c0a10fbbd0bed7379e949cc19fe36fbcbcc59a9fe30a2662d3e4d22862e8841b587b8995ef8482bc60fe0863b41752ef3dd44a387eff101595822bf1ce440ff9e5f73e560e4f7fbfe4754d9dabbcd92de02017eb43d3cf7c75e45ba04009a782a68ce11eefd52253c721daa5f37c6408e37b48d1f2e36d7c1793300f2c9039e69a52057486b63c0fa644d00528ce48f2e551ca88e356ac25ae74c73492ed3e6233490acfbe7ed8244f23e2af86e0ade6b78bb34a75a86f6cbadbd39762680cb0821d6d28f18d427df13d0e747f6da54be970e43ef8ca8285dc8bf44e3cecdbf2d8757a9800bb889b846d58cc636a2648809451a95736a0ecec6ea3fe61fb24dcd8a00ac0b8933918189cda555b17e431d99ee190d6d0d9f769e665ec193ba8889ae72a01e18b98cebb75d20ed778e5778ef657ce85d40eafa44b46f293d64023b877e8c5d58587c3abecf9a1ad8d874a4cdba0bfbea61b7eb19e81f7c932be12a83bacc51017b42dbe2931dc11c742a5a942cb6ed9bd9922ad78f55b0f6cbae0e8d4235140263ed8c83ab22e71a0f0a62b6920b5d5109e415254e527546546bd025cf1583e3e8d9d5bf735a4651fa2e5c3c86a185bb77e9b75224cdda8cb0eb21d9e3bb19e286832aa5dce19f055539a0a5caccfd752742a31d0af882c4f02c29cbd90ac2cdf5cc61c448cd09eb7b82b930ca99962c0e5ed84124fe37f7d30aad0296ee340377a7e0aa7413c495ac8ab0b482c4c5f59872efd5a1ceadbc7606e67d3c79a77d095bd82519db0893b9d2bbc2b2f3a7391826840e49424703c006399cde5f2a52a9383e89dfbfca284be4d75dd3aafd8a43dc6c71bd7fde9460647eb5c97707e96ddb9124d6020da38ee7ad743db8fd0377a8711905194c496e39a2132d7bbf35b79f920b6dcaa73625bf8b5320da250513cd45bf42c8072809ad59d69c02f0554cf82b79ff291e42d9227de1948352b0dba0281b69876ae0ca24972a5e75aee7e0a46bd4fc83f5a0dd3f22d666f2d950ca580c6da6dfaaa293beded10d1328613611b6e01d5d8567541e81466467302d8050a3ae4791fbddc1aec749edb68173be5341166c1d5c42d63e7368473e48bafa43459de3fa3a5550a4ac979711dd9a2d6796b0bcf9b5881124ade4b12bf64fa55724976a0da9d642e76a036c430f5fb2c06d599b0f78e978580f8eb763d2846177ff18b9b5cf8c76197ed809ef24212bc5563a1713214ce78e0e6cced6e41578d46a07839795c83c189610244bc1b680535fce39f290da90d719078015d90020b1d4567a97081b48514709df8e327d814e8c15496d90efacae6b13e297ed520d280203896bbc3a23f3b638adf594de03a782bb292a93ef0b14b8b3e13c01787a0b7bfb3abd8ab15eebbc651b7b054d3e56ebb7808de9b9bd067560ec6a6432455b37054292a3d9d32434506bf84b2907560017089de3f60c2deb4dfb7371f96d65a575d446aa1d2df81867135120df4e24e9227f72ff9f8f015a7754948704ecd084a1a93fbeb5a44af086ef73e9fc1c072b7d5473e92558fc2824acf27f1dbe9b019247d3074bf4256a966ceb674a2c4222632c8e4b6c0736de019ccfe4cca40b9b07f8c4df9753cdfb4ad66643ed71510983e29c2b5f9ae7db4913cb74d9dd0461a900810650d0da73f766aa6882385f3bb40644bf43f01faf2aa4cd187659edb0498527f201442b64349afa814b3dae5ce815971f3b11d177e3e1aaf90c7674c097d475640218ad27e63f9071c9081c06d9b5d1f3a070da3eed4f4080190a74063e7f97b5f35706dd1173dcbfa13a70d5362e50d57d0c5105c8d3beb926d93f61699e737ebe1a935839c3aa5b629dc93aa209d9e7774c40de7f59fca1eb274a8280022a15934e5dd2579a8cf5cd16a3b0a1ff3ea712c4258164fe2fa17a4cbfa5630f4041bad4204605eb2e762d610fa17dafa415ed8a678da1d4b5a6618d71d0066d66e3ac10b3ce65137a5a02344abc57f1be4ce0cbf1a2ac66dcb5e94495e863819c627e4704fb479c232b27aa4a5dfca8896a7eb8e0592b6b392ec9fa2767f569d5c1356d7ef7a909d8ee344ba017c75ca664d98f5288230b7f1ffa2fa7a5d07fab5f4b53b7f19c3fb361795fd632fa8a654004d931b4b7fc0890927aec727160cded3c01b7e40e6b81ce015796895f9c007762a1c22acfb9513eccd93c845e91ea8b0960b299b3ce788cbcce5bea9a94325289d2c3573975c512d56e19c4655f849b3652f8b5f9fa6f49e03202f2031debe3c299c3ceceb1febf4b285da9033493088a36f885ed6d3958b8d05cc6be00f3465de8bf6e41796d17e393067585b459b143d592cea102f584e48676a45f896cf662bd6b3b2309aa7f46d2b8ec6597a063f12bcc88922050c8c1e070134ce77ab1cb7a7f29983a0b30d9b2abeca5cfbfc55e941376c616c2834b1c1c9a9473b531c86c3b708478ee95923fe6a8108c2c4dc8a78a9d5e995f6c815b292b986cab0afa233ef10567a49d4e8dc17f438b90b620df4d291b52549ac8e1b69078b62011ed4bb0e288db740817ff07d01e779e11cb8e0606b5ca3aac6c7b262499f5a115acdad8a67b6eb77503318ef3bf0008347b270aa986d9e79e2af174f38a4743250c1091e6053a7a785464483161aad3ef3ad976e5329b71afe9bbfd93d7541a1014db4cc159ac266021e841c665217fa150e130f921ebd4cfb5accdb87f5f9bc0fd94b402289db4d0ac3f0906a689aef044c09fc2c5a00f7795ea935aeb943eb32826bd2176c1d1cb058195e3229d293595ebc07514c6b038a1d964199c59e59d4fc621c54b7bbd3410ccec22f7fb6751527c2aa0940ed2f0c9dcfc4e99ced91d09ba4a37042b5f48b127439cad24df2951ff1e769d3892dc4788dbbe27cce60f7f0138789444712e84e059ac0a4e87557f6c3369fc61b9a843c816df3cb4ec77a11e16390234da24dc0420f6a44554fc7954cc74d63ec030d4d964898e14500d0dacdbb2959f7a8a191773f66448348f36c3f4904187088bcfeafda7dd721236810d04469e93ca4e7926305c25b1ef1380d775008fd238e33e8dd2dc5a9783f97414487a7ef70eba3dcf71331803fad223f65aadfc87d79512bf311c14926d619a089f5e84c46f4a9ff393969f8eacc8fa20acaa9eb01a8aab625853e415d3871e555a11ee71ee93cba85ee9cde60b3962e294c2c840f0a1ba87714bac54f1ca0ebda74daa3e8e19d382b951d64a22da48c632ec5754f42129214a807427e69a93c128b6b0a8697c9ee375818dd79244a38287fe8f66c7cc3aa18aee2fbf804fc1aadcc7d2daf75be82a60276b6902a51f2bbb64c261915b80053fb9635f405f1fa855d1ec8adc0ebe9648b8151eda70ec5ad5f704fa2a337bcfb7ecbc845a11cae7a68d6bc58f107ac7bb0c2f6b83edc48703ba00c94036b9af4ada51d6d78bfe697df06f47573c14cd7191ec52dc0f208ecdcf54669529bba2c2fb7a6b38f6f2b5ec5fe876f03c096ae092b6f881a84b00edd1e9f67449069d876afaa99eb1a446f20656b5104c72ed28bd8553c724785f4e8bfdc33194409960de4969b708ce26e4cd608d21ace0c38e27d54b55369a9e807cfda9a6240466dd94f6150d4b0105f7b9ae392009b2cf146d1dad5d7c8664463d7d60d11b45f30d01db7364e21ac557d37a4c9ad88926c472e98710d2cbfc4b70d6a5dbb128d46909e634761c6f6952bf9021aa5282c391dcee3278a25e3e2ee31a7f6713979a546084fb2e598214c36a3b7618bf23c57bb23b33e9c98dfe5192ef257dc2d891a6f7c11be334fbdab015eedafe1c4aea95ff1fa6d340d0cade542f3f782c1589470fa64c6fd9ac0c31536ecee0ae312f992733beea6fcaf7562dd6e0f2c016f712ce14d93f02a54f577c75b444fd7f46e9bd2cd9cd1f89195781d88f984eca45c97355095d3b48b0d9bd730c7d6f63b1dc78d2344bdb0f18c4e1554822345c11efa2ba32bcef4f29ed05315cf44617a80d7d1392de077bbda08669c8c3cb6c0b12f872f1247bc1d07634bf5bf4acc3a4ecdae7e6acd7c4af9820147afe55500a7270d7eb511f907339e5af54cfaf33e2364f54091ebee2a245ba048452d383cd441604c4dd1c6376e4df8b83ebf6070d2be248174fc1dc0a1352c103325360aeb3ab71cb73bb646ac6247dd68155fd48b90250c3b0f250a74f827780367e117a94094e5005e2f926accaef0b3e36c25e315c1e80cd4c3481f3465d99025c7de91c45bb8dd0a5577174c1f366017d87d2033239a8b6f399a9095845b5fafe9cca113b93f455bb790709b6c93fcbbd0c4bd7b5d621088dca06802e241836291226ad56d40b3b4e90eb68bd5845742baf4cb4a69b4bdb07f02d0bd6fbb5a5fad3af030816b254725e6db4073b7a0536b884c8985c3a159cdb105c73f7e0e03546248336449eff6afeb96cf8ad3617df18ee2247bc2d11ebbe10e0379f5578c41611872c5461541fb4da5be3f3348e0592982a61c352315370a9b452306c9f31f9040ef755ad096a8733dd9daf6bdbcb7a3521ad2282ae4fa7bfdb9cda5997ba3a6652af46c6d0205bb356dfb411e2b931b357723bb70254211819b74a461ed5c126cec6573cda4f6107fc3ebc76483621e9ab5789a5575ea3a91463f76138ea0f3ec9c44e1cddb2de59bef83333d235e922b920e267453676575b38e6415bd136534b8df2360ab489fb69eefd04b66758ab5dd105be7b0635f7194f9e4b158b22b21ac97fda4e804747a9718b40a32531cd5c3fd1d3c1dd8ba5ef9c86d3c8df8c71f81da1a9756e5db4dddf70755053f7129d656a8069fe83c39ab240cf7a73f0f880ec7a791c5115ab262184839b906c238eaabf2268dfcd6560c5bcb70fea00b580ad52e7de0333e6de63ae351952e6e5dee6edf284de0a2f53e2089db13bd5eca5f98883a24eb2e1a58ae199f8db9c60a5b6b85585b2d2a17d6b5406e5668685d95c4718c375db05f7953b363c25d2ed0906eda70eb659845acd31fec9b8e4d5951d12fd50bbb969dd824a78c72622c8311a980f0f2e6a1ddc368879a1f3a07d3c0780e85a4e5d13223a3424782e3f77bf6a1ebf823f468d41b777ff61345064f1096ed653c277bab90ca5afc8ad6d25f4447236cdd82950afff27763f3fef5308f034379f4ad4955cb8cc5280d51b5427de4eba374f64dde2f1e7a6ae628aa4696160a5cf0ae9fc70e307b4eb19c0a5af2c2855710c8e117211d73a7e7f3f7f2ba55d03a4b73d816c9c3fc1edb86ec95ddcd77884a913805ad6549e7a5f776a1c2385dd6d83877727f128207cda29f83462269a7f606fa31934d06a6e0efd238d0a180c754a9d2e85609fd20c880ea0e79cbe887c442f9f682801da783529e1e45eb3e70195fa2711fa291dca43ee0672b7afc14cf87b9506a7ebe223019c856777e1783f6ae1b0ed90486b32e3b6f7ff77be834c7b6676da6c8052fa49450e3e16a6f90ee33742bbfe3dc025832e0bbc7abeb625077b8c1ea07dee89c7dc26fa42514ff9ac21e848e32309bc2862a873fb57796e05923fce42fa2833c73866e22a04497ec13acebcdff6ae1df71dd8756f1febac04f2034c1f3e1d401ddbdb7f2ef676d5c85437830d527a5fb04c9bbf0d892ee1306d2d2df37008916a3a66e70f865cd6d25de16fdb4bb4f2616204cf86a3ffdbf147223968c092a46dc2aae4aedb32fb850b85d4adb87bfada328bce4c2c70ec42affde442179fcc1d3d9f5e4a848c8ba03b0df3065d1b2d5f1b08d8c25148c51bb54e191a87ea59903084000b4b520fffda111fe831d4bdcf62423c1fcd673b020c5f2c41973dd1b9698054368081f917715e1c1592bc78dd265e051bcda5bf5877821fedfcf7790a58b328cf780f71ee71491e59194504bc800d319251607e53ba0e1ed15cd4fd5c959eaff4d3a1c7cb28c479f2776256633ef7c0f0e98688b54e8c8634cf57e27e5c1ee1e43573ae23bfbb1ff1bef6cabd33c02ff165c44f0f190426ba8391ba4f03458be3351869c5c5c9d5fa5600edbcce523525b9cd9c3bb040e34771ea277d05cb76302c72fac5edc815412dbbbc651371d70d044c4f89a68da7abd836fb3a495e212b5fd13819c41c9a240405582ae69b7c35b30935af3085d457a4d76a94c9272c5eafcecc4c92dd4f314b04b4739864e626a5bab27fa2f345f052afe3bae2ff4c442c42a1c83091bfcc23a3b5e06a511d02cefcd618a6d9761de00af192cf1aacc902cf3ba98f898c48fbc74b6710db7ac890b4f7ed7377e0fa3b4c46a131e775130a80db5014a79e674c8fc8b45495066e88201d2e320320fa4561abab617d0e67e9e879b0080a8ab404f4eb007a088990aa6a7b29afce5b8dd038ce96d43e1271315f6070e761e759c44fba1ce78730e35ca31e0bf5840cc01289c81613a07c497f288ed70a6d10d9f58fe135558b2a862bd877fcc939d7536e7dc988409290cd73da04a3b1399b0a2637f737d5f86bba4a31019546e2000a3ca57f8291cd9af28299eb93909061200c9738cca998add04e7bb0137ecc460fc3ef72872e7d13c159914fcdf577910e6c5d7a1636b13b78c5088551c614e3c75befb0f37fb89b918f4aad0126a9efd3390d6a0cab97ed0e01c7eae0e798a4142345578beb10d6b61a90b4d1fe836022def90bb8e37e07428a4592e7bf30e935951e492234a8db96f081379e7c4e18c3b6ce4ed1f97698dc1da940f14217e877bb8e0f33b392d801a01c48ec62ce2774d2e4e55e9415c063e1bfa31a8f0633443ec19c5fab977c1485147e46c06f86742278fd071de4a165dff7eddd5390a1e031d80e3d44477f6009c9fc27a7d92b865a292b0d586083f681c2d92da7e7f42eabd076fa7d61eba0c2b406c75f1cec561b1a523dd4c6f344b02ed59bd473d7d30a24144e981fc8da434931adeb841d63bb705485f8f58a180da91af64bad1379356787b37467dc9b4a0d12496e5048e7ccb40a978eebee5eaac4e9dd96faf194aa93a22333d7f68cccde147dce26c9ff18d7c8ffe0d1377c70dd1057d54473b2c2b2b3eea82fb223952c0dc3796efd0cd94afea38341ab9a83c6a9ee77f26bf8dea8510dfc964f9b9b4942c08ade50e43f06e5101f2e6b68b6a7f9cc5443c862b1198627461938daf4bd1fc7b21d6d7fd3f775f0e4a1f60434a242b049f159dbe5de145e741c5c9b4e59a7f5d7de54a6d51cd87845dde819ca74e3abf60356fbcf18bfff3b6ae1c545e243c08f9f41b86e55ed6e71be453843e0bffc5b6bdcfeefd33075ee5110627d4f05e008e54ddd62fb6979d9c2a5e4a2cb45fad7b2d77bd17508952889b30df2124cdc2fe6a749a12c9f6dbbd01226cc4ba2693b7e6a858d3c36ac6519ee70e896588a6df81b0e3be3604bbbe1a845088cf1834a04368dde8b6ee76d0492911dc09b05cf6642e0003cd8faafd398872c1a8dc3e85d3658ec8", 0x2000, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)={0x90, 0x0, 0x8, {0x3, 0x3, 0x100000003, 0x0, 0x0, 0x3881fffc, {0x5, 0x7, 0x1, 0x0, 0x3, 0x0, 0xa, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x5, 0x8009}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) setxattr$system_posix_acl(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='system.posix_acl_default\x00', &(0x7f0000000680)={{}, {0x1, 0x4}, [{0x2, 0x6}, {0x2, 0x5}, {0x2, 0x4}, {0x2, 0x7}, {0x2, 0x1}, {0x2, 0x1}, {0x2, 0x3}], {0x4, 0x3}, [{}, {0x8, 0x5}], {0x10, 0x4}}, 0x6c, 0x1) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) mount$9p_unix(&(0x7f0000000380)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000180)='./file1\x00', &(0x7f0000000300), 0x2, &(0x7f0000000740)) preadv2(r2, &(0x7f0000001300)=[{&(0x7f0000001580)=""/4101, 0x1005}], 0x1, 0x1, 0x3, 0x510) mount$overlay(0x0, 0x0, 0x0, 0x0, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1800, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r4) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="1201100112201040ac0501854e9e0102030109021b0001000090000904a000010e010000090505"], 0x0) r5 = syz_pidfd_open(r1, 0x0) setns(r5, 0x24020000) r6 = socket$inet_tcp(0x2, 0x1, 0x0) syz_pidfd_open(r1, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) getsockopt$inet_tcp_buf(r6, 0x6, 0xb, 0x0, &(0x7f0000000100)) umount2(&(0x7f0000000040)='.\x00', 0x2) 86.122208ms ago: executing program 7 (id=3813): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000400)='./binderfs/binder1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000140)={0x73622a85, 0x1381, 0x3}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000280)={@mcast2, 0x800, 0x0, 0x103, 0x1}, 0x20) r1 = syz_open_procfs(0x0, 0x0) pread64(r1, 0x0, 0x0, 0x9a) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000500)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0xfeff, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000440)={@ptr={0x70742a85, 0x0, &(0x7f0000000280)=""/238, 0xee, 0x2, 0x4}, @fda={0x66646185, 0x1, 0x0, 0xe}, @fda={0x66646185, 0x6, 0x0, 0x24}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}, 0x1000}], 0x0, 0x0, 0x0}) 1.14763ms ago: executing program 7 (id=3814): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='personality\x00') exit(0x0) readv(r0, &(0x7f0000000040)=[{&(0x7f0000000100)=""/222, 0xde}], 0x1) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x0, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) mmap$binder(&(0x7f00000a0000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) 0s ago: executing program 8 (id=3815): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000080)='./binderfs/binder1\x00', 0x1002, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00220f000000540b4550182195e079000000000000"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGFIELDINFO(r1, 0xc038480a, &(0x7f0000000080)={0x1, 0x200, 0x10ac, 0x4, 0x7, 0x82, 0x4, 0x5, 0x1, 0x8, 0x7, 0x3ff, 0x1, 0x54}) kernel console output (not intermixed with test programs): number 44 using dummy_hcd [ 216.641556][ T424] usb 9-1: USB disconnect, device number 3 [ 216.641580][ C0] kye 0003:0458:5010.001A: usb_submit_urb(ctrl) failed: -19 [ 216.659984][ T844] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 216.712212][ T355] usb 7-1: Using ep0 maxpacket: 32 [ 216.725739][ T7294] FAULT_INJECTION: forcing a failure. [ 216.725739][ T7294] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 216.726463][ T355] usb 7-1: config 0 has an invalid interface number: 184 but max is 0 [ 216.739030][ T7294] CPU: 1 UID: 0 PID: 7294 Comm: syz.7.2793 Not tainted syzkaller #0 ecd017b10525a6fce0a0b730885af6e9bd831db9 [ 216.739058][ T7294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 216.739070][ T7294] Call Trace: [ 216.739076][ T7294] [ 216.739084][ T7294] __dump_stack+0x21/0x30 [ 216.739111][ T7294] dump_stack_lvl+0x10c/0x190 [ 216.739132][ T7294] ? __cfi_dump_stack_lvl+0x10/0x10 [ 216.739153][ T7294] ? unwind_get_return_address+0x51/0x90 [ 216.739174][ T7294] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 216.739199][ T7294] dump_stack+0x19/0x20 [ 216.739218][ T7294] should_fail_ex+0x3d9/0x530 [ 216.739243][ T7294] should_fail+0xf/0x20 [ 216.739265][ T7294] should_fail_usercopy+0x1e/0x30 [ 216.739282][ T7294] _copy_from_user+0x22/0xb0 [ 216.739301][ T7294] ___sys_recvmsg+0x12f/0x510 [ 216.739319][ T7294] ? __sys_recvmsg+0x280/0x280 [ 216.739337][ T7294] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 216.739360][ T7294] ? selinux_file_permission+0x309/0xb30 [ 216.739381][ T7294] ? __fget_files+0x2c5/0x340 [ 216.739401][ T7294] do_recvmmsg+0x326/0x770 [ 216.739419][ T7294] ? __sys_recvmmsg+0x290/0x290 [ 216.739436][ T7294] ? __cfi_vfs_write+0x10/0x10 [ 216.739455][ T7294] ? fput+0x1a5/0x240 [ 216.739475][ T7294] __x64_sys_recvmmsg+0x191/0x240 [ 216.739493][ T7294] ? __cfi___x64_sys_recvmmsg+0x10/0x10 [ 216.739511][ T7294] ? __kasan_check_read+0x15/0x20 [ 216.739535][ T7294] x64_sys_call+0x292c/0x2ee0 [ 216.739557][ T7294] do_syscall_64+0x58/0xf0 [ 216.739580][ T7294] ? clear_bhb_loop+0x50/0xa0 [ 216.739599][ T7294] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 216.739618][ T7294] RIP: 0033:0x7fd8fe98ebe9 [ 216.739633][ T7294] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 216.739648][ T7294] RSP: 002b:00007fd8ff75d038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 216.739668][ T7294] RAX: ffffffffffffffda RBX: 00007fd8febc5fa0 RCX: 00007fd8fe98ebe9 [ 216.739682][ T7294] RDX: 0000000000000007 RSI: 0000200000001b40 RDI: 0000000000000003 [ 216.739694][ T7294] RBP: 00007fd8ff75d090 R08: 0000000000000000 R09: 0000000000000000 [ 216.739706][ T7294] R10: 0000000040000100 R11: 0000000000000246 R12: 0000000000000001 [ 216.739719][ T7294] R13: 00007fd8febc6038 R14: 00007fd8febc5fa0 R15: 00007fffa27da378 [ 216.739734][ T7294] [ 216.841874][ T844] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 216.844553][ T355] usb 7-1: config 0 has no interface number 0 [ 216.849210][ T844] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 216.853563][ T355] usb 7-1: config 0 interface 184 has no altsetting 0 [ 216.859054][ T844] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 216.885248][ T355] usb 7-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 216.887705][ T844] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 216.892857][ T355] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 216.897310][ T844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 216.902968][ T355] usb 7-1: Product: syz [ 216.908583][ T844] usb 2-1: config 0 descriptor?? [ 216.926852][ T355] usb 7-1: Manufacturer: syz [ 217.072086][ T355] usb 7-1: SerialNumber: syz [ 217.078183][ T355] usb 7-1: config 0 descriptor?? [ 217.089721][ T355] smsc75xx v1.0.0 [ 217.350651][ T844] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 217.358157][ T844] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 217.366311][ T844] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 217.374250][ T844] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 217.382232][ T844] plantronics 0003:047F:FFFF.001B: unknown main item tag 0x0 [ 217.390635][ T844] plantronics 0003:047F:FFFF.001B: No inputs registered, leaving [ 217.402025][ T844] plantronics 0003:047F:FFFF.001B: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 217.622756][ T1211] usb 2-1: USB disconnect, device number 36 [ 217.694829][ T355] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 217.716528][ T355] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 217.825690][ T7313] usb usb8: usbfs: process 7313 (syz.7.2800) did not claim interface 0 before use [ 217.951847][ T7321] overlayfs: overlapping lowerdir path [ 218.030998][ T7325] overlayfs: unescaped trailing colons in lowerdir mount option. [ 218.248371][ T7329] netlink: 37 bytes leftover after parsing attributes in process `syz.1.2807'. [ 218.289823][ T844] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 218.403339][ T36] kauditd_printk_skb: 1436 callbacks suppressed [ 218.403355][ T36] audit: type=1400 audit(1756941157.960:16147): avc: denied { create } for pid=7334 comm="syz.1.2810" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 218.432731][ T36] audit: type=1400 audit(1756941157.990:16148): avc: denied { read write } for pid=7334 comm="syz.1.2810" name="fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 218.457093][ T36] audit: type=1400 audit(1756941157.990:16149): avc: denied { read write open } for pid=7334 comm="syz.1.2810" path="/dev/fuse" dev="devtmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 218.500651][ T36] audit: type=1400 audit(1756941157.990:16150): avc: denied { mounton } for pid=7334 comm="syz.1.2810" path="/305/file0" dev="tmpfs" ino=1615 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 218.523863][ T844] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 218.534853][ T844] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 218.551831][ T844] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 218.564761][ T36] audit: type=1400 audit(1756941157.990:16151): avc: denied { unlink } for pid=4271 comm="syz-executor" name="file0" dev="tmpfs" ino=1615 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 218.566325][ T355] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -71 [ 218.587549][ T844] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 218.617569][ T36] audit: type=1400 audit(1756941157.990:16152): avc: denied { read write } for pid=4271 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 218.644151][ T355] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -71 [ 218.646801][ T844] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 218.654991][ T355] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 218.672091][ T355] smsc75xx 7-1:0.184: probe with driver smsc75xx failed with error -71 [ 218.674740][ T7339] overlayfs: overlapping lowerdir path [ 218.684745][ T355] usb 7-1: USB disconnect, device number 44 [ 218.687379][ T844] usb 9-1: config 0 descriptor?? [ 218.696767][ T36] audit: type=1400 audit(1756941157.990:16153): avc: denied { read write open } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 218.746651][ T36] audit: type=1400 audit(1756941157.990:16154): avc: denied { ioctl } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 218.772271][ T36] audit: type=1400 audit(1756941158.050:16155): avc: denied { ioctl } for pid=7324 comm="syz.8.2805" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 218.809817][ T36] audit: type=1400 audit(1756941158.050:16156): avc: denied { ioctl } for pid=7324 comm="syz.8.2805" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 218.865073][ T7343] overlayfs: unescaped trailing colons in lowerdir mount option. [ 218.890479][ T7342] rust_binder: Write failure EFAULT in pid:164 [ 218.904788][ T7342] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2811'. [ 218.951315][ T7345] netlink: 188 bytes leftover after parsing attributes in process `syz.7.2815'. [ 219.119865][ T424] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 219.192117][ T844] usbhid 9-1:0.0: can't add hid device: -71 [ 219.198124][ T844] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 219.210387][ T844] usb 9-1: USB disconnect, device number 4 [ 219.296045][ T424] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 219.309815][ T424] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 219.319571][ T424] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 219.335604][ T424] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 219.345858][ T424] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.355967][ T424] usb 2-1: config 0 descriptor?? [ 219.482469][ T7369] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:178 [ 219.545385][ T7370] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 219.554701][ T7370] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:883 [ 219.765007][ T7373] netlink: 188 bytes leftover after parsing attributes in process `syz.7.2828'. [ 219.785702][ T424] plantronics 0003:047F:FFFF.001C: unknown main item tag 0x0 [ 219.804761][ T424] plantronics 0003:047F:FFFF.001C: unknown main item tag 0x0 [ 219.820126][ T424] plantronics 0003:047F:FFFF.001C: unknown main item tag 0x0 [ 219.839846][ T424] plantronics 0003:047F:FFFF.001C: unknown main item tag 0x0 [ 219.852679][ T424] plantronics 0003:047F:FFFF.001C: unknown main item tag 0x0 [ 219.876476][ T424] plantronics 0003:047F:FFFF.001C: No inputs registered, leaving [ 219.897112][ T424] plantronics 0003:047F:FFFF.001C: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 219.950470][ T7381] rust_binder: Error while translating object. [ 219.950525][ T7381] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 219.957673][ T7381] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:59 [ 220.049663][ T7386] rust_binder: Write failure EFAULT in pid:185 [ 220.050896][ T355] usb 2-1: USB disconnect, device number 37 [ 220.094313][ T7388] rust_binder: Write failure EFAULT in pid:63 [ 220.124603][ T7388] netlink: 24 bytes leftover after parsing attributes in process `syz.8.2835'. [ 220.136413][ T7390] rust_binder: Write failure EINVAL in pid:187 [ 220.264484][ T7401] netlink: 188 bytes leftover after parsing attributes in process `syz.7.2840'. [ 220.374924][ T7410] netlink: 37 bytes leftover after parsing attributes in process `syz.7.2843'. [ 220.409818][ T424] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 220.544400][ T7416] rust_binder: Error while translating object. [ 220.544446][ T7416] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 220.551126][ T7416] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:893 [ 220.560915][ T424] usb 9-1: Using ep0 maxpacket: 16 [ 220.584265][ T424] usb 9-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 220.619815][ T424] usb 9-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 220.639807][ T424] usb 9-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 220.656109][ T424] usb 9-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 220.699810][ T424] usb 9-1: config 7 interface 0 has no altsetting 0 [ 220.706454][ T424] usb 9-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 220.749041][ T424] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 220.778019][ T7422] rust_binder: validate_parent_fixup: fixup_min_offset=57, parent_offset=37 [ 220.778041][ T7422] rust_binder: Error while translating object. [ 220.803837][ T7422] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 220.819819][ T7422] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:897 [ 221.006202][ T7433] netlink: 188 bytes leftover after parsing attributes in process `syz.7.2854'. [ 221.029835][ T844] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 221.073529][ T7435] netlink: 37 bytes leftover after parsing attributes in process `syz.6.2856'. [ 221.178908][ T355] hid-generic 0000:0000:0000.001D: unknown main item tag 0x0 [ 221.211894][ T844] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 221.217831][ T355] hid-generic 0000:0000:0000.001D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 221.239224][ T424] input: HID 0458:5010 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:7.0/0003:0458:5010.001E/input/input18 [ 221.252414][ T844] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 221.272503][ T844] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 221.294937][ T844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 221.304429][ T424] kye 0003:0458:5010.001E: input,hiddev96,hidraw1: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.8-1/input0 [ 221.329806][ T844] usb 2-1: SerialNumber: syz [ 221.383972][ T7441] FAULT_INJECTION: forcing a failure. [ 221.383972][ T7441] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 221.399798][ T7441] CPU: 1 UID: 0 PID: 7441 Comm: syz.7.2855 Not tainted syzkaller #0 ecd017b10525a6fce0a0b730885af6e9bd831db9 [ 221.399829][ T7441] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 221.399841][ T7441] Call Trace: [ 221.399848][ T7441] [ 221.399856][ T7441] __dump_stack+0x21/0x30 [ 221.399886][ T7441] dump_stack_lvl+0x10c/0x190 [ 221.399907][ T7441] ? __cfi_dump_stack_lvl+0x10/0x10 [ 221.399927][ T7441] ? avc_xperms_populate+0x292/0x620 [ 221.399949][ T7441] dump_stack+0x19/0x20 [ 221.399970][ T7441] should_fail_ex+0x3d9/0x530 [ 221.399996][ T7441] should_fail+0xf/0x20 [ 221.400018][ T7441] should_fail_usercopy+0x1e/0x30 [ 221.400035][ T7441] _copy_to_iter+0x3bb/0x14b0 [ 221.400055][ T7441] ? __cfi__copy_to_iter+0x10/0x10 [ 221.400073][ T7441] ? __check_object_size+0x50a/0x810 [ 221.400088][ T7441] ? __cfi___check_object_size+0x10/0x10 [ 221.400105][ T7441] ? __skb_try_recv_datagram+0x3df/0x4e0 [ 221.400131][ T7441] __skb_datagram_iter+0x103/0x930 [ 221.400156][ T7441] ? __cfi_simple_copy_to_iter+0x10/0x10 [ 221.400181][ T7441] skb_copy_datagram_iter+0x44/0x160 [ 221.400206][ T7441] netlink_recvmsg+0x2c5/0xdf0 [ 221.400226][ T7441] ? __cfi_netlink_recvmsg+0x10/0x10 [ 221.400246][ T7441] ? bpf_lsm_socket_recvmsg+0xd/0x20 [ 221.400267][ T7441] ? security_socket_recvmsg+0x3a/0xf0 [ 221.400285][ T7441] ? __cfi_netlink_recvmsg+0x10/0x10 [ 221.400302][ T7441] sock_recvmsg+0x219/0x270 [ 221.400326][ T7441] ____sys_recvmsg+0x1ca/0x460 [ 221.400345][ T7441] ? __sys_recvmsg_sock+0x60/0x60 [ 221.400366][ T7441] ? import_iovec+0x81/0xb0 [ 221.400386][ T7441] ___sys_recvmsg+0x1b6/0x510 [ 221.400404][ T7441] ? __sys_recvmsg+0x280/0x280 [ 221.400423][ T7441] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 221.400448][ T7441] ? selinux_file_permission+0x309/0xb30 [ 221.400471][ T7441] ? __fget_files+0x2c5/0x340 [ 221.400491][ T7441] do_recvmmsg+0x326/0x770 [ 221.400511][ T7441] ? __sys_recvmmsg+0x290/0x290 [ 221.400529][ T7441] ? __cfi_vfs_write+0x10/0x10 [ 221.400548][ T7441] ? fput+0x1a5/0x240 [ 221.400569][ T7441] __x64_sys_recvmmsg+0x191/0x240 [ 221.400588][ T7441] ? __cfi___x64_sys_recvmmsg+0x10/0x10 [ 221.400608][ T7441] ? __kasan_check_read+0x15/0x20 [ 221.400633][ T7441] x64_sys_call+0x292c/0x2ee0 [ 221.400664][ T7441] do_syscall_64+0x58/0xf0 [ 221.400686][ T7441] ? clear_bhb_loop+0x50/0xa0 [ 221.400707][ T7441] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 221.400727][ T7441] RIP: 0033:0x7fd8fe98ebe9 [ 221.400743][ T7441] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 221.400759][ T7441] RSP: 002b:00007fd8ff75d038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 221.400779][ T7441] RAX: ffffffffffffffda RBX: 00007fd8febc5fa0 RCX: 00007fd8fe98ebe9 [ 221.400795][ T7441] RDX: 0000000000000007 RSI: 0000200000001b40 RDI: 0000000000000003 [ 221.400808][ T7441] RBP: 00007fd8ff75d090 R08: 0000000000000000 R09: 0000000000000000 [ 221.400820][ T7441] R10: 0000000040000100 R11: 0000000000000246 R12: 0000000000000001 [ 221.400833][ T7441] R13: 00007fd8febc6038 R14: 00007fd8febc5fa0 R15: 00007fffa27da378 [ 221.400850][ T7441] [ 221.729517][ T844] usb 2-1: 0:2 : does not exist [ 221.743603][ T844] usb 2-1: USB disconnect, device number 38 [ 221.841643][ T332] udevd[332]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 221.889829][ T355] usb 9-1: USB disconnect, device number 5 [ 222.334904][ T7458] /dev/rnullb0: Can't open blockdev [ 222.769817][ T10] usb 7-1: new high-speed USB device number 45 using dummy_hcd [ 222.849824][ T844] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 222.919827][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 222.926728][ T10] usb 7-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 222.936879][ T10] usb 7-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 222.947745][ T10] usb 7-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 222.957508][ T10] usb 7-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 222.972700][ T10] usb 7-1: config 7 interface 0 has no altsetting 0 [ 222.979300][ T10] usb 7-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 222.988342][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 223.003084][ T844] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 223.013627][ T844] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 223.024619][ T844] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 223.033693][ T844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 223.042175][ T844] usb 2-1: SerialNumber: syz [ 223.254297][ T844] usb 2-1: 0:2 : does not exist [ 223.264801][ T844] usb 2-1: USB disconnect, device number 39 [ 223.303706][ T4863] udevd[4863]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 223.420048][ T10] input: HID 0458:5010 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:7.0/0003:0458:5010.001F/input/input19 [ 223.433801][ T36] kauditd_printk_skb: 719 callbacks suppressed [ 223.433817][ T36] audit: type=1400 audit(1756941162.992:16876): avc: denied { read } for pid=94 comm="acpid" name="event3" dev="devtmpfs" ino=950 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 223.464308][ T36] audit: type=1400 audit(1756941162.992:16877): avc: denied { read open } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=950 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 223.490892][ T10] kye 0003:0458:5010.001F: input,hiddev96,hidraw0: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.6-1/input0 [ 223.505268][ T36] audit: type=1400 audit(1756941163.042:16878): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=950 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 223.537968][ T36] audit: type=1400 audit(1756941163.042:16879): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=950 ioctlcmd=0x4521 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 223.563900][ T36] audit: type=1400 audit(1756941163.042:16880): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=950 ioctlcmd=0x4523 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 223.588738][ T36] audit: type=1400 audit(1756941163.042:16881): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=950 ioctlcmd=0x4524 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 223.613598][ T36] audit: type=1400 audit(1756941163.062:16882): avc: denied { read } for pid=94 comm="acpid" name="event3" dev="devtmpfs" ino=950 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 223.636855][ T36] audit: type=1400 audit(1756941163.062:16883): avc: denied { read open } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=950 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 223.661234][ T36] audit: type=1400 audit(1756941163.122:16884): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=950 ioctlcmd=0x4520 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 223.686584][ T36] audit: type=1400 audit(1756941163.122:16885): avc: denied { ioctl } for pid=94 comm="acpid" path="/dev/input/event3" dev="devtmpfs" ino=950 ioctlcmd=0x4521 scontext=system_u:system_r:acpid_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 223.822450][ T424] usb 7-1: USB disconnect, device number 45 [ 223.822559][ C0] kye 0003:0458:5010.001F: usb_submit_urb(ctrl) failed: -19 [ 224.081829][ T10] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 224.239812][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 224.246810][ T10] usb 2-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 224.257473][ T10] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 224.268358][ T10] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 224.278095][ T10] usb 2-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 224.290872][ T10] usb 2-1: config 7 interface 0 has no altsetting 0 [ 224.297454][ T10] usb 2-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 224.306516][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.314542][ T355] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 224.469802][ T355] usb 9-1: Using ep0 maxpacket: 16 [ 224.476843][ T355] usb 9-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 224.487862][ T355] usb 9-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 224.499989][ T355] usb 9-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 224.510322][ T355] usb 9-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 224.523184][ T355] usb 9-1: config 7 interface 0 has no altsetting 0 [ 224.529843][ T355] usb 9-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 224.538935][ T355] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 224.656538][ T7501] rust_binder: Error while translating object. [ 224.656584][ T7501] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 224.662829][ T7501] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:934 [ 224.762113][ T10] input: HID 0458:5010 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:7.0/0003:0458:5010.0020/input/input20 [ 224.799897][ T10] kye 0003:0458:5010.0020: input,hiddev96,hidraw0: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.1-1/input0 [ 224.949900][ T424] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 224.974184][ T355] input: HID 0458:5010 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:7.0/0003:0458:5010.0021/input/input21 [ 225.043337][ T355] kye 0003:0458:5010.0021: input,hiddev97,hidraw1: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.8-1/input0 [ 225.102059][ T424] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 225.112828][ T424] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 225.123891][ T424] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 225.133005][ T424] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 225.141030][ T424] usb 7-1: SerialNumber: syz [ 225.158004][ T355] usb 2-1: USB disconnect, device number 40 [ 225.158044][ C0] kye 0003:0458:5010.0020: usb_submit_urb(ctrl) failed: -19 [ 225.300129][ T7508] rust_binder: pid 7508 performed invalid decrement on ref [ 225.304687][ T844] usb 9-1: USB disconnect, device number 6 [ 225.307848][ T7508] rust_binder: Failed to allocate buffer. len:8, is_oneway:false [ 225.358412][ T424] usb 7-1: 0:2 : does not exist [ 225.394746][ T424] usb 7-1: USB disconnect, device number 46 [ 225.464734][ T332] udevd[332]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 225.652727][ T7513] netlink: 37 bytes leftover after parsing attributes in process `syz.7.2885'. [ 225.744412][ T7517] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 225.745919][ T7517] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 225.753092][ T7517] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 225.761120][ T7517] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:771 [ 225.911966][ T7524] veth1_vlan: mtu greater than device maximum [ 226.035607][ T7530] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 226.128109][ T7541] rust_binder: Error while translating object. [ 226.128156][ T7541] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 226.149870][ T7541] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:89 [ 226.432169][ T7550] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1393116026 (2786232052 ns) > initial count (2693593528 ns). Using initial count to start timer. [ 226.509843][ T10] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 226.659834][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 226.666978][ T10] usb 2-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 226.677139][ T10] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 226.688044][ T10] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 226.697781][ T10] usb 2-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 226.710566][ T10] usb 2-1: config 7 interface 0 has no altsetting 0 [ 226.717143][ T10] usb 2-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 226.726182][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 227.100034][ T7560] overlay: ./file0 is not a directory [ 227.151842][ T10] input: HID 0458:5010 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:7.0/0003:0458:5010.0022/input/input22 [ 227.168394][ T10] kye 0003:0458:5010.0022: input,hiddev96,hidraw0: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.1-1/input0 [ 227.401821][ T7567] netlink: 37 bytes leftover after parsing attributes in process `syz.6.2907'. [ 227.440941][ T7570] overlayfs: missing 'lowerdir' [ 227.465546][ T844] usb 2-1: USB disconnect, device number 41 [ 228.476473][ T36] kauditd_printk_skb: 1717 callbacks suppressed [ 228.476490][ T36] audit: type=1400 audit(1756941168.026:18603): avc: denied { read write } for pid=4271 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 228.587380][ T36] audit: type=1400 audit(1756941168.056:18604): avc: denied { read write open } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 228.668391][ T36] audit: type=1400 audit(1756941168.056:18605): avc: denied { ioctl } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 228.694123][ T36] audit: type=1400 audit(1756941168.126:18606): avc: denied { read write } for pid=4271 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 228.719700][ T36] audit: type=1400 audit(1756941168.126:18607): avc: denied { read write open } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 228.745102][ T36] audit: type=1400 audit(1756941168.136:18608): avc: denied { ioctl } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 228.778267][ T36] audit: type=1400 audit(1756941168.216:18609): avc: denied { read write } for pid=3451 comm="syz-executor" name="loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 228.819819][ T36] audit: type=1400 audit(1756941168.216:18610): avc: denied { read write open } for pid=3451 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 228.848857][ T7597] fuse: Unknown parameter 'grou00000000000000000000' [ 228.879811][ T36] audit: type=1400 audit(1756941168.216:18611): avc: denied { ioctl } for pid=3451 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 228.929837][ T36] audit: type=1400 audit(1756941168.246:18612): avc: denied { read write } for pid=4271 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 228.971562][ T7603] overlayfs: missing 'lowerdir' [ 229.054146][ T7612] overlayfs: unescaped trailing colons in lowerdir mount option. [ 229.077349][ T7615] rust_binder: Error while translating object. [ 229.077394][ T7615] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 229.083678][ T7615] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:963 [ 229.160933][ T7619] rust_binder: 965: no such ref 0 [ 229.164171][ T7621] fuse: Unknown parameter 'grou00000000000000000000' [ 229.192915][ T7619] rust_binder: BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 229.229830][ T7619] rust_binder: 965: no such ref 0 [ 229.297909][ T7627] overlayfs: missing 'lowerdir' [ 229.489105][ T7635] FAULT_INJECTION: forcing a failure. [ 229.489105][ T7635] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 229.503514][ T7635] CPU: 1 UID: 0 PID: 7635 Comm: syz.1.2937 Not tainted syzkaller #0 ecd017b10525a6fce0a0b730885af6e9bd831db9 [ 229.503542][ T7635] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 229.503554][ T7635] Call Trace: [ 229.503561][ T7635] [ 229.503569][ T7635] __dump_stack+0x21/0x30 [ 229.503596][ T7635] dump_stack_lvl+0x10c/0x190 [ 229.503618][ T7635] ? __cfi_dump_stack_lvl+0x10/0x10 [ 229.503640][ T7635] ? __sys_recvmsg_sock+0x60/0x60 [ 229.503660][ T7635] dump_stack+0x19/0x20 [ 229.503688][ T7635] should_fail_ex+0x3d9/0x530 [ 229.503713][ T7635] should_fail+0xf/0x20 [ 229.503736][ T7635] should_fail_usercopy+0x1e/0x30 [ 229.503754][ T7635] _copy_from_user+0x22/0xb0 [ 229.503774][ T7635] ___sys_recvmsg+0x12f/0x510 [ 229.503793][ T7635] ? __sys_recvmsg+0x280/0x280 [ 229.503812][ T7635] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 229.503837][ T7635] ? selinux_file_permission+0x309/0xb30 [ 229.503860][ T7635] ? __fget_files+0x2c5/0x340 [ 229.503880][ T7635] do_recvmmsg+0x326/0x770 [ 229.503900][ T7635] ? __sys_recvmmsg+0x290/0x290 [ 229.503918][ T7635] ? __cfi_vfs_write+0x10/0x10 [ 229.503936][ T7635] ? fput+0x1a5/0x240 [ 229.503958][ T7635] __x64_sys_recvmmsg+0x191/0x240 [ 229.503976][ T7635] ? __cfi___x64_sys_recvmmsg+0x10/0x10 [ 229.503994][ T7635] ? __kasan_check_read+0x15/0x20 [ 229.504019][ T7635] x64_sys_call+0x292c/0x2ee0 [ 229.504043][ T7635] do_syscall_64+0x58/0xf0 [ 229.504067][ T7635] ? clear_bhb_loop+0x50/0xa0 [ 229.504088][ T7635] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 229.504107][ T7635] RIP: 0033:0x7f632358ebe9 [ 229.504123][ T7635] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 229.504140][ T7635] RSP: 002b:00007f6324453038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 229.504161][ T7635] RAX: ffffffffffffffda RBX: 00007f63237c5fa0 RCX: 00007f632358ebe9 [ 229.504176][ T7635] RDX: 0000000000000007 RSI: 0000200000001b40 RDI: 0000000000000003 [ 229.504189][ T7635] RBP: 00007f6324453090 R08: 0000000000000000 R09: 0000000000000000 [ 229.504202][ T7635] R10: 0000000040000100 R11: 0000000000000246 R12: 0000000000000002 [ 229.504215][ T7635] R13: 00007f63237c6038 R14: 00007f63237c5fa0 R15: 00007ffe72787808 [ 229.504232][ T7635] [ 229.732476][ T844] usb 7-1: new high-speed USB device number 47 using dummy_hcd [ 229.877663][ T844] usb 7-1: device descriptor read/64, error -71 [ 229.881223][ T7650] netlink: 188 bytes leftover after parsing attributes in process `syz.8.2942'. [ 230.001802][ T7648] fuse: Unknown parameter 'grou00000000000000000000' [ 230.019834][ T392] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 230.119831][ T844] usb 7-1: device descriptor read/64, error -71 [ 230.257151][ T7672] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 230.257180][ T7672] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 230.265847][ T7672] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:127 [ 230.336086][ T7678] netlink: 188 bytes leftover after parsing attributes in process `syz.8.2953'. [ 230.369913][ T844] usb 7-1: new high-speed USB device number 48 using dummy_hcd [ 230.395945][ T7670] pim6reg1: entered promiscuous mode [ 230.409617][ T7681] fuse: Unknown parameter 'group_i00000000000000000000' [ 230.429582][ T7670] pim6reg1: entered allmulticast mode [ 230.519987][ T844] usb 7-1: device descriptor read/64, error -71 [ 230.546848][ T7687] pim6reg1: entered promiscuous mode [ 230.563776][ T7687] pim6reg1: entered allmulticast mode [ 230.759829][ T844] usb 7-1: device descriptor read/64, error -71 [ 230.768683][ T7698] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 230.770848][ T7698] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 230.777289][ T7698] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 230.786127][ T7698] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:847 [ 230.819823][ T331] usb 9-1: new full-speed USB device number 7 using dummy_hcd [ 230.862629][ T7702] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 230.864579][ T7702] rust_binder: Error in use_page_slow: ESRCH [ 230.871513][ T844] usb usb7-port1: attempt power cycle [ 230.883109][ T7702] rust_binder: use_range failure ESRCH [ 230.883135][ T7702] rust_binder: Failed to allocate buffer. len:4232, is_oneway:false [ 230.888669][ T7702] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 230.897496][ T7702] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:851 [ 230.935122][ T7704] fuse: Unknown parameter 'group_i00000000000000000000' [ 230.979824][ T331] usb 9-1: device descriptor read/64, error -71 [ 231.096372][ T7716] overlayfs: missing 'workdir' [ 231.191292][ T7722] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 231.192729][ T7722] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 231.199182][ T7722] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 231.207127][ T7722] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:871 [ 231.229849][ T844] usb 7-1: new high-speed USB device number 49 using dummy_hcd [ 231.247273][ T331] usb 9-1: device descriptor read/64, error -71 [ 231.259739][ T7724] fuse: Unknown parameter 'group_i00000000000000000000' [ 231.281865][ T844] usb 7-1: device descriptor read/8, error -71 [ 231.414063][ T844] usb 7-1: device descriptor read/8, error -71 [ 231.499834][ T331] usb 9-1: new full-speed USB device number 8 using dummy_hcd [ 231.649835][ T331] usb 9-1: device descriptor read/64, error -71 [ 231.659835][ T844] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 231.682397][ T844] usb 7-1: device descriptor read/8, error -71 [ 231.766022][ T7745] fuse: Unknown parameter 'group_id00000000000000000000' [ 231.825706][ T844] usb 7-1: device descriptor read/8, error -71 [ 231.889833][ T331] usb 9-1: device descriptor read/64, error -71 [ 231.939883][ T844] usb usb7-port1: unable to enumerate USB device [ 232.000283][ T331] usb usb9-port1: attempt power cycle [ 232.039823][ T10] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 232.191688][ T10] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 232.203254][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 232.214146][ T10] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 232.223888][ T10] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 232.236761][ T10] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 232.245790][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 232.255041][ T10] usb 2-1: config 0 descriptor?? [ 232.339860][ T331] usb 9-1: new full-speed USB device number 9 using dummy_hcd [ 232.367581][ T331] usb 9-1: device descriptor read/8, error -71 [ 232.445100][ T7757] FAULT_INJECTION: forcing a failure. [ 232.445100][ T7757] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 232.458235][ T7757] CPU: 1 UID: 0 PID: 7757 Comm: syz.6.2988 Not tainted syzkaller #0 ecd017b10525a6fce0a0b730885af6e9bd831db9 [ 232.458263][ T7757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 232.458275][ T7757] Call Trace: [ 232.458281][ T7757] [ 232.458289][ T7757] __dump_stack+0x21/0x30 [ 232.458317][ T7757] dump_stack_lvl+0x10c/0x190 [ 232.458339][ T7757] ? __cfi_dump_stack_lvl+0x10/0x10 [ 232.458354][ T7757] ? __sys_recvmsg_sock+0x60/0x60 [ 232.458379][ T7757] dump_stack+0x19/0x20 [ 232.458400][ T7757] should_fail_ex+0x3d9/0x530 [ 232.458426][ T7757] should_fail+0xf/0x20 [ 232.458445][ T7757] should_fail_usercopy+0x1e/0x30 [ 232.458455][ T7757] _copy_from_user+0x22/0xb0 [ 232.458466][ T7757] ___sys_recvmsg+0x12f/0x510 [ 232.458477][ T7757] ? __sys_recvmsg+0x280/0x280 [ 232.458487][ T7757] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 232.458501][ T7757] ? selinux_file_permission+0x309/0xb30 [ 232.458523][ T7757] ? __fget_files+0x2c5/0x340 [ 232.458544][ T7757] do_recvmmsg+0x326/0x770 [ 232.458564][ T7757] ? __sys_recvmmsg+0x290/0x290 [ 232.458581][ T7757] ? __cfi_vfs_write+0x10/0x10 [ 232.458593][ T7757] ? fput+0x1a5/0x240 [ 232.458604][ T7757] __x64_sys_recvmmsg+0x191/0x240 [ 232.458615][ T7757] ? __cfi___x64_sys_recvmmsg+0x10/0x10 [ 232.458628][ T7757] ? __kasan_check_read+0x15/0x20 [ 232.458642][ T7757] x64_sys_call+0x292c/0x2ee0 [ 232.458664][ T7757] do_syscall_64+0x58/0xf0 [ 232.458687][ T7757] ? clear_bhb_loop+0x50/0xa0 [ 232.458708][ T7757] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 232.458726][ T7757] RIP: 0033:0x7f2215d8ebe9 [ 232.458736][ T7757] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 232.458745][ T7757] RSP: 002b:00007f2216cda038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 232.458757][ T7757] RAX: ffffffffffffffda RBX: 00007f2215fc5fa0 RCX: 00007f2215d8ebe9 [ 232.458765][ T7757] RDX: 0000000000000007 RSI: 0000200000001b40 RDI: 0000000000000003 [ 232.458772][ T7757] RBP: 00007f2216cda090 R08: 0000000000000000 R09: 0000000000000000 [ 232.458779][ T7757] R10: 0000000040000100 R11: 0000000000000246 R12: 0000000000000002 [ 232.458786][ T7757] R13: 00007f2215fc6038 R14: 00007f2215fc5fa0 R15: 00007ffe2844ce88 [ 232.458801][ T7757] [ 232.592566][ T331] usb 9-1: device descriptor read/8, error -71 [ 232.686652][ T7761] rust_binder: Failed to allocate buffer. len:10771147061988852024, is_oneway:false [ 232.689741][ T7761] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 232.699933][ T7761] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:981 [ 232.700468][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.747249][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.764902][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.776969][ T7763] fuse: Unknown parameter 'group_id00000000000000000000' [ 232.779850][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.798485][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.819828][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.849059][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.860720][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.868225][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.876999][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.885172][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.916415][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.938363][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.954902][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.972820][ T10] plantronics 0003:047F:FFFF.0023: unknown main item tag 0x0 [ 232.981100][ T10] plantronics 0003:047F:FFFF.0023: No inputs registered, leaving [ 233.009983][ T10] plantronics 0003:047F:FFFF.0023: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 233.034715][ T10] usb 2-1: USB disconnect, device number 43 [ 233.079886][ T331] usb 9-1: new full-speed USB device number 10 using dummy_hcd [ 233.096939][ T7773] fido_id[7773]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 233.131326][ T331] usb 9-1: device descriptor read/8, error -71 [ 233.256066][ T7781] netlink: 292 bytes leftover after parsing attributes in process `syz.6.2999'. [ 233.272361][ T331] usb 9-1: device descriptor read/8, error -71 [ 233.301277][ T7783] tipc: Enabled bearer , priority 0 [ 233.328051][ T7783] syzkaller0: entered promiscuous mode [ 233.337656][ T7783] syzkaller0: entered allmulticast mode [ 233.343538][ T7783] tipc: Resetting bearer [ 233.352469][ T7782] tipc: Resetting bearer [ 233.366113][ T7782] tipc: Disabling bearer [ 233.392622][ T331] usb usb9-port1: unable to enumerate USB device [ 233.510783][ T36] kauditd_printk_skb: 1164 callbacks suppressed [ 233.510800][ T36] audit: type=1400 audit(1756941173.063:19777): avc: denied { create } for pid=7790 comm="syz.1.3005" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 233.552980][ T36] audit: type=1400 audit(1756941173.063:19778): avc: denied { read open } for pid=7784 comm="syz.7.3001" path="net:[4026532432]" dev="nsfs" ino=4026532432 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 233.618314][ T36] audit: type=1400 audit(1756941173.063:19779): avc: denied { create } for pid=7784 comm="syz.7.3001" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 233.641535][ T36] audit: type=1400 audit(1756941173.063:19780): avc: denied { create } for pid=7784 comm="syz.7.3001" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 233.650503][ T7797] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3008'. [ 233.670024][ T36] audit: type=1400 audit(1756941173.063:19781): avc: denied { write } for pid=7784 comm="syz.7.3001" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 233.749853][ T36] audit: type=1400 audit(1756941173.063:19782): avc: denied { read } for pid=7784 comm="syz.7.3001" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 233.790760][ T36] audit: type=1400 audit(1756941173.063:19783): avc: denied { read } for pid=7784 comm="syz.7.3001" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 233.856220][ T7808] audit: audit_backlog=65 > audit_backlog_limit=64 [ 233.857525][ T7810] audit: audit_backlog=65 > audit_backlog_limit=64 [ 233.862803][ T36] audit: type=1400 audit(1756941173.063:19784): avc: denied { read } for pid=7784 comm="syz.7.3001" dev="nsfs" ino=4026532432 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 234.184164][ T7833] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3024'. [ 234.852115][ T7872] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3044'. [ 235.209830][ T844] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 235.319617][ T7905] rust_binder: Error while translating object. [ 235.319663][ T7905] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 235.326115][ T7905] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:193 [ 235.389804][ T844] usb 2-1: Using ep0 maxpacket: 16 [ 235.398801][ T7909] rust_binder: Error while translating object. [ 235.401806][ T844] usb 2-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 235.407569][ T7909] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 235.420305][ T7909] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:197 [ 235.432675][ T844] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 235.461432][ T844] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 235.478159][ T7913] netlink: 224 bytes leftover after parsing attributes in process `syz.8.3061'. [ 235.487321][ T844] usb 2-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 235.506411][ T7912] netlink: 37 bytes leftover after parsing attributes in process `syz.6.3060'. [ 235.531037][ T844] usb 2-1: config 7 interface 0 has no altsetting 0 [ 235.548425][ T844] usb 2-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 235.566859][ T844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 235.847815][ T7929] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 235.856586][ T7929] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 235.865804][ T7929] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 236.033548][ T844] input: HID 0458:5010 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:7.0/0003:0458:5010.0024/input/input23 [ 236.069963][ T844] kye 0003:0458:5010.0024: input,hiddev96,hidraw0: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.1-1/input0 [ 236.253297][ T7947] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 236.262132][ T7947] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 236.271429][ T7947] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 236.425576][ T10] usb 2-1: USB disconnect, device number 44 [ 236.425625][ C1] kye 0003:0458:5010.0024: usb_submit_urb(ctrl) failed: -19 [ 236.523400][ T7962] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 236.523427][ T7962] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 236.534251][ T7962] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1049 [ 236.650860][ T7971] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 236.678765][ T7971] overlayfs: option "uuid=on" requires an upper fs, falling back to uuid=null. [ 236.688340][ T7971] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 236.691528][ T7975] rust_binder: 1053: no such ref 2 [ 236.711871][ T7975] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1053 [ 237.040974][ T7989] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 237.109379][ T7989] rust_binder: Error in use_page_slow: ESRCH [ 237.127341][ T7989] rust_binder: use_range failure ESRCH [ 237.133690][ T7989] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 237.149829][ T7989] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 237.166130][ T7989] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:915 [ 237.170919][ T7994] netlink: 'syz.6.3098': attribute type 46 has an invalid length. [ 237.230468][ T7996] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 237.230496][ T7996] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 237.238462][ T7996] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:265 [ 237.319909][ T331] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 237.489840][ T331] usb 9-1: Using ep0 maxpacket: 32 [ 237.496902][ T331] usb 9-1: config index 0 descriptor too short (expected 29220, got 36) [ 237.506198][ T331] usb 9-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 237.514841][ T331] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 237.523845][ T331] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 237.533528][ T331] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 237.543297][ T331] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 237.556297][ T331] usb 9-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 237.565354][ T331] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 237.574470][ T331] usb 9-1: config 0 descriptor?? [ 237.683345][ T8013] fuse: Bad value for 'fd' [ 237.785742][ T8019] netlink: 37 bytes leftover after parsing attributes in process `syz.6.3108'. [ 237.796414][ T331] usblp 9-1:0.0: usblp0: USB Bidirectional printer dev 11 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 237.809276][ T331] usb 9-1: USB disconnect, device number 11 [ 237.822453][ T331] usblp0: removed [ 237.923695][ T8025] rust_binder: Error while translating object. [ 237.923740][ T8025] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 237.931459][ T8025] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:1086 [ 238.058360][ T8033] fuse: Bad value for 'fd' [ 238.135873][ T8037] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 238.140033][ T8039] netlink: 'syz.6.3116': attribute type 1 has an invalid length. [ 238.144176][ T8037] rust_binder: Failed to allocate buffer. len:4160, is_oneway:true [ 238.149807][ T8039] netlink: 72 bytes leftover after parsing attributes in process `syz.6.3116'. [ 238.154329][ T8037] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 238.171944][ T8037] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:921 [ 238.249824][ T844] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 238.261051][ T8045] input: syz0 as /devices/virtual/input/input24 [ 238.302124][ T8047] binder: Unknown parameter 'dRfcontfxt' [ 238.340496][ T8045] serio: Serial port ttyS3 [ 238.441469][ T844] usb 9-1: Using ep0 maxpacket: 32 [ 238.468982][ T844] usb 9-1: config index 0 descriptor too short (expected 29220, got 36) [ 238.481714][ T844] usb 9-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 238.491318][ T844] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 238.504022][ T844] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 238.514258][ T844] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 238.524489][ T844] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 238.538602][ T36] kauditd_printk_skb: 1749 callbacks suppressed [ 238.538616][ T36] audit: type=1400 audit(1756941178.084:21524): avc: denied { ioctl } for pid=8044 comm="syz.1.3119" path="/dev/uinput" dev="devtmpfs" ino=194 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:event_device_t tclass=chr_file permissive=1 [ 238.569975][ T844] usb 9-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 238.579010][ T844] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 238.587662][ T36] audit: type=1400 audit(1756941178.124:21525): avc: denied { write } for pid=8044 comm="syz.1.3119" name="001" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 238.610834][ T844] usb 9-1: config 0 descriptor?? [ 238.639815][ T36] audit: type=1400 audit(1756941178.124:21526): avc: denied { write } for pid=8044 comm="syz.1.3119" path="/dev/bus/usb/008/001" dev="devtmpfs" ino=117 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 238.675832][ T36] audit: type=1400 audit(1756941178.174:21527): avc: denied { ioctl } for pid=7988 comm="syz.8.3096" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x550a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 238.700830][ T36] audit: type=1400 audit(1756941178.174:21528): avc: denied { ioctl } for pid=7988 comm="syz.8.3096" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5509 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 238.725981][ T36] audit: type=1400 audit(1756941178.174:21529): avc: denied { ioctl } for pid=7988 comm="syz.8.3096" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5506 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 238.750956][ T36] audit: type=1400 audit(1756941178.174:21530): avc: denied { ioctl } for pid=7988 comm="syz.8.3096" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5506 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 238.776109][ T36] audit: type=1400 audit(1756941178.174:21531): avc: denied { ioctl } for pid=7988 comm="syz.8.3096" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5505 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 238.801081][ T36] audit: type=1400 audit(1756941178.174:21532): avc: denied { ioctl } for pid=7988 comm="syz.8.3096" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5505 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 238.826213][ T36] audit: type=1400 audit(1756941178.174:21533): avc: denied { ioctl } for pid=7988 comm="syz.8.3096" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5504 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 239.066001][ T844] usblp 9-1:0.0: usblp0: USB Bidirectional printer dev 12 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 239.119445][ T844] usb 9-1: USB disconnect, device number 12 [ 239.126785][ T844] usblp0: removed [ 239.617608][ T8058] fuse: Bad value for 'fd' [ 239.764929][ T8070] binder: Unknown parameter 'fscontext?}' [ 239.866127][ T8074] rust_binder: Failed to allocate buffer. len:4288, is_oneway:true [ 239.866153][ T8074] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 239.874269][ T8074] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1118 [ 239.918752][ T8078] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 239.928191][ T8078] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1120 [ 240.010099][ T8080] netlink: 37 bytes leftover after parsing attributes in process `syz.6.3132'. [ 240.088961][ T8084] fuse: Bad value for 'fd' [ 240.123978][ T8086] rust_binder: Error while translating object. [ 240.124025][ T8086] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 240.130286][ T8086] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:1130 [ 240.170076][ T8088] netlink: 'syz.6.3136': attribute type 4 has an invalid length. [ 240.197697][ T8088] netlink: 'syz.6.3136': attribute type 4 has an invalid length. [ 240.429068][ T8092] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 240.479842][ T844] usb 7-1: new full-speed USB device number 51 using dummy_hcd [ 240.581224][ T8100] fuse: Bad value for 'fd' [ 240.627593][ T8102] rust_binder: Failed to allocate buffer. len:4376, is_oneway:true [ 240.627622][ T8102] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 240.635734][ T8102] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:277 [ 240.652721][ T844] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 240.695110][ T844] usb 7-1: New USB device found, idVendor=5543, idProduct=006e, bcdDevice= 0.00 [ 240.721342][ T844] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 240.748252][ T844] usb 7-1: config 0 descriptor?? [ 240.760926][ T8090] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 240.989654][ T844] usbhid 7-1:0.0: can't add hid device: -71 [ 240.999912][ T844] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 241.026528][ T844] usb 7-1: USB disconnect, device number 51 [ 241.038795][ T8127] fuse: Invalid rootmode [ 241.188867][ T8136] FAULT_INJECTION: forcing a failure. [ 241.188867][ T8136] name failslab, interval 1, probability 0, space 0, times 0 [ 241.213836][ T8136] CPU: 0 UID: 0 PID: 8136 Comm: syz.8.3156 Not tainted syzkaller #0 ecd017b10525a6fce0a0b730885af6e9bd831db9 [ 241.213866][ T8136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 241.213878][ T8136] Call Trace: [ 241.213884][ T8136] [ 241.213892][ T8136] __dump_stack+0x21/0x30 [ 241.213920][ T8136] dump_stack_lvl+0x10c/0x190 [ 241.213942][ T8136] ? __cfi_dump_stack_lvl+0x10/0x10 [ 241.213966][ T8136] dump_stack+0x19/0x20 [ 241.213985][ T8136] should_fail_ex+0x3d9/0x530 [ 241.214010][ T8136] should_failslab+0xac/0x100 [ 241.214028][ T8136] kmem_cache_alloc_noprof+0x42/0x3a0 [ 241.214054][ T8136] ? getname_flags+0xc6/0x710 [ 241.214073][ T8136] getname_flags+0xc6/0x710 [ 241.214091][ T8136] user_path_at+0x2b/0x60 [ 241.214111][ T8136] __se_sys_mount+0x288/0x480 [ 241.214128][ T8136] ? ksys_write+0x1ef/0x250 [ 241.214145][ T8136] ? __x64_sys_mount+0xf0/0xf0 [ 241.214163][ T8136] __x64_sys_mount+0xc3/0xf0 [ 241.214181][ T8136] x64_sys_call+0x2021/0x2ee0 [ 241.214206][ T8136] do_syscall_64+0x58/0xf0 [ 241.214229][ T8136] ? clear_bhb_loop+0x50/0xa0 [ 241.214250][ T8136] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 241.214269][ T8136] RIP: 0033:0x7fd83eb8ebe9 [ 241.214284][ T8136] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 241.214300][ T8136] RSP: 002b:00007fd83fabf038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 241.214322][ T8136] RAX: ffffffffffffffda RBX: 00007fd83edc5fa0 RCX: 00007fd83eb8ebe9 [ 241.214337][ T8136] RDX: 0000200000000000 RSI: 0000200000000180 RDI: 0000000000000000 [ 241.214351][ T8136] RBP: 00007fd83fabf090 R08: 0000200000000040 R09: 0000000000000000 [ 241.214365][ T8136] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 241.214377][ T8136] R13: 00007fd83edc6038 R14: 00007fd83edc5fa0 R15: 00007ffeec590058 [ 241.214392][ T8136] [ 241.584035][ T8145] netlink: 224 bytes leftover after parsing attributes in process `syz.8.3161'. [ 241.622050][ T8147] fuse: Invalid rootmode [ 241.699865][ T331] usb 7-1: new high-speed USB device number 52 using dummy_hcd [ 241.849812][ T331] usb 7-1: Using ep0 maxpacket: 16 [ 241.857245][ T331] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 241.866301][ T331] usb 7-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 241.875981][ T331] usb 7-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 241.885663][ T331] usb 7-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 241.895398][ T331] usb 7-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 241.905150][ T331] usb 7-1: config 1 interface 0 has no altsetting 0 [ 241.911770][ T331] usb 7-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 241.920805][ T331] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 241.932695][ T331] ums-sddr09 7-1:1.0: USB Mass Storage device detected [ 242.134848][ T331] scsi host1: usb-storage 7-1:1.0 [ 242.715186][ T8156] bpf: Bad value for 'gid' [ 242.737670][ T8156] random: crng reseeded on system resumption [ 242.841176][ T8162] SELinux: security_context_str_to_sid (sytem_uGй :) failed with errno=-22 [ 243.021100][ T8175] batadv_slave_1: entered promiscuous mode [ 243.044865][ T8179] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 243.050528][ T8179] rust_binder: Error in use_page_slow: ESRCH [ 243.056966][ T8179] rust_binder: use_range failure ESRCH [ 243.068752][ T8179] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 243.074571][ T8179] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 243.082966][ T8179] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:947 [ 243.120898][ T8181] netlink: 'syz.1.3174': attribute type 4 has an invalid length. [ 243.169978][ T1470] scsi 1:0:0:0: Direct-Access Sandisk ImageMate SDDR09 0177 PQ: 0 ANSI: 0 [ 243.201668][ T844] usb 7-1: USB disconnect, device number 52 [ 243.239992][ T1493] sd 1:0:0:0: [sdb] Read Capacity(10) failed: Result: hostbyte=0x07 driverbyte=DRIVER_OK [ 243.256081][ T1493] sd 1:0:0:0: [sdb] Sense not available. [ 243.272477][ T1493] sd 1:0:0:0: [sdb] 0 512-byte logical blocks: (0 B/0 B) [ 243.279528][ T1493] sd 1:0:0:0: [sdb] 0-byte physical blocks [ 243.303646][ T1493] sd 1:0:0:0: [sdb] Write Protect is off [ 243.309385][ T1493] sd 1:0:0:0: [sdb] Asking for cache data failed [ 243.335958][ T1493] sd 1:0:0:0: [sdb] Assuming drive cache: write through [ 243.367188][ T1493] sd 1:0:0:0: [sdb] Attached SCSI removable disk [ 243.396533][ T8188] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 243.399394][ T8188] rust_binder: Error in use_page_slow: ESRCH [ 243.405980][ T8188] rust_binder: use_range failure ESRCH [ 243.412036][ T8188] rust_binder: Failed to allocate buffer. len:4232, is_oneway:false [ 243.417579][ T8188] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 243.425658][ T8188] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:956 [ 243.526446][ T332] udevd[332]: inotify_add_watch(7, /dev/sdb, 10) failed: No such file or directory [ 243.544987][ T36] kauditd_printk_skb: 533 callbacks suppressed [ 243.545001][ T36] audit: type=1400 audit(1756941183.100:22067): avc: denied { mount } for pid=8190 comm="syz.1.3178" name="/" dev="overlay" ino=2120 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 243.580965][ T36] audit: type=1400 audit(1756941183.110:22068): avc: denied { unmount } for pid=4271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 243.601683][ T36] audit: type=1400 audit(1756941183.130:22069): avc: denied { unmount } for pid=4271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 243.622426][ T36] audit: type=1400 audit(1756941183.140:22070): avc: denied { read write } for pid=4271 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 243.679585][ T8195] rust_binder: Write failure EFAULT in pid:960 [ 243.684453][ T36] audit: type=1400 audit(1756941183.140:22071): avc: denied { read write open } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 243.717524][ T36] audit: type=1400 audit(1756941183.140:22072): avc: denied { ioctl } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 243.772934][ T332] udevd[332]: inotify_add_watch(7, /dev/sdb, 10) failed: No such file or directory [ 243.794756][ T36] audit: type=1400 audit(1756941183.230:22073): avc: denied { read } for pid=8192 comm="syz.1.3179" name="binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 243.810276][ T8171] batadv_slave_1: left promiscuous mode [ 243.820744][ T36] audit: type=1400 audit(1756941183.230:22074): avc: denied { read open } for pid=8192 comm="syz.1.3179" path="/dev/binderfs/binder0" dev="binder" ino=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 243.860555][ T36] audit: type=1400 audit(1756941183.230:22075): avc: denied { create } for pid=8192 comm="syz.1.3179" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 243.870542][ T8198] 9pnet_fd: Insufficient options for proto=fd [ 243.883327][ T36] audit: type=1400 audit(1756941183.230:22076): avc: denied { ioctl } for pid=8192 comm="syz.1.3179" path="/dev/binderfs/binder0" dev="binder" ino=16 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 243.943864][ T8205] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 243.960219][ T8205] rust_binder: Failed to allocate buffer. len:45592, is_oneway:true [ 243.966677][ T8205] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 243.982718][ T8204] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:292 [ 244.012718][ T8205] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:965 [ 244.087889][ T8215] netlink: 'syz.1.3188': attribute type 12 has an invalid length. [ 244.129805][ T8215] netlink: 188 bytes leftover after parsing attributes in process `syz.1.3188'. [ 244.196702][ T8223] overlayfs: unescaped trailing colons in lowerdir mount option. [ 244.229813][ T424] usb 7-1: new low-speed USB device number 53 using dummy_hcd [ 244.389812][ T424] usb 7-1: Invalid ep0 maxpacket: 64 [ 244.489833][ T844] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 244.519871][ T424] usb 7-1: new low-speed USB device number 54 using dummy_hcd [ 244.594551][ T10] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 244.642192][ T844] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 244.653581][ T844] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 244.664221][ T844] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 244.678781][ T844] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 244.688324][ T424] usb 7-1: Invalid ep0 maxpacket: 64 [ 244.695744][ T844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.696246][ T8242] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:297 [ 244.704570][ T424] usb usb7-port1: attempt power cycle [ 244.730967][ T844] usb 2-1: config 0 descriptor?? [ 244.759856][ T10] usb 9-1: Using ep0 maxpacket: 16 [ 244.771841][ T10] usb 9-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 244.782375][ T10] usb 9-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 244.794157][ T10] usb 9-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 244.804562][ T10] usb 9-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 244.825187][ T10] usb 9-1: config 7 interface 0 has no altsetting 0 [ 244.833112][ T10] usb 9-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 244.842893][ T10] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 244.850659][ T8246] netlink: 224 bytes leftover after parsing attributes in process `syz.7.3199'. [ 245.069884][ T424] usb 7-1: new low-speed USB device number 55 using dummy_hcd [ 245.090552][ T424] usb 7-1: Invalid ep0 maxpacket: 64 [ 245.145325][ T844] plantronics 0003:047F:FFFF.0025: unknown main item tag 0x0 [ 245.153751][ T844] plantronics 0003:047F:FFFF.0025: unknown main item tag 0x0 [ 245.161413][ T844] plantronics 0003:047F:FFFF.0025: unknown main item tag 0x0 [ 245.168851][ T844] plantronics 0003:047F:FFFF.0025: unknown main item tag 0x0 [ 245.176791][ T844] plantronics 0003:047F:FFFF.0025: unknown main item tag 0x0 [ 245.185918][ T844] plantronics 0003:047F:FFFF.0025: No inputs registered, leaving [ 245.205295][ T844] plantronics 0003:047F:FFFF.0025: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 245.219839][ T424] usb 7-1: new low-speed USB device number 56 using dummy_hcd [ 245.250409][ T424] usb 7-1: Invalid ep0 maxpacket: 64 [ 245.255815][ T424] usb usb7-port1: unable to enumerate USB device [ 245.291427][ T10] input: HID 0458:5010 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:7.0/0003:0458:5010.0026/input/input25 [ 245.327369][ T10] kye 0003:0458:5010.0026: input,hiddev97,hidraw1: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.8-1/input0 [ 245.432174][ T10] usb 2-1: USB disconnect, device number 45 [ 245.491288][ T424] usb 9-1: USB disconnect, device number 13 [ 246.050595][ T8267] netlink: 37 bytes leftover after parsing attributes in process `syz.8.3207'. [ 246.310003][ T8281] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 246.314005][ T8281] rust_binder: Failed to allocate buffer. len:69568, is_oneway:true [ 246.321408][ T8281] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 246.329405][ T8281] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:975 [ 246.493798][ T8289] fuse: Unknown parameter 'user_i00000000000000000000' [ 246.597386][ T8291] netlink: 37 bytes leftover after parsing attributes in process `syz.7.3219'. [ 246.619813][ T355] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 246.779812][ T355] usb 9-1: Using ep0 maxpacket: 16 [ 246.807188][ T355] usb 9-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 246.827465][ T355] usb 9-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 246.840391][ T355] usb 9-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 246.850917][ T355] usb 9-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 246.865476][ T355] usb 9-1: config 7 interface 0 has no altsetting 0 [ 246.873533][ T355] usb 9-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 246.883904][ T8308] fuse: Unknown parameter 'user_i00000000000000000000' [ 246.890820][ T355] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 247.061894][ T8319] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 247.065373][ T8319] rust_binder: Error in use_page_slow: ESRCH [ 247.072360][ T8319] rust_binder: use_range failure ESRCH [ 247.082020][ T8319] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 247.087503][ T8319] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 247.100117][ T8319] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:997 [ 247.234832][ T8330] fuse: Unknown parameter 'user_i00000000000000000000' [ 247.348286][ T355] input: HID 0458:5010 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:7.0/0003:0458:5010.0027/input/input26 [ 247.381589][ T355] kye 0003:0458:5010.0027: input,hiddev96,hidraw0: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.8-1/input0 [ 247.645299][ T8347] IPv6: NLM_F_CREATE should be specified when creating new route [ 247.662301][ T355] usb 9-1: USB disconnect, device number 14 [ 247.662339][ C0] kye 0003:0458:5010.0027: usb_submit_urb(ctrl) failed: -19 [ 247.716665][ T8350] netlink: 188 bytes leftover after parsing attributes in process `syz.7.3243'. [ 247.855340][ T8356] fuse: Unknown parameter 'user_id00000000000000000000' [ 248.103336][ T8366] loop2: detected capacity change from 0 to 7 [ 248.110442][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 248.119599][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 248.127562][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 248.136728][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 248.153051][ T8366] loop2: unable to read partition table [ 248.161352][ T8366] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 248.174345][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 248.183954][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 248.192279][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 248.193061][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 248.201439][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 248.227125][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 248.236311][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 248.245665][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 248.254831][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 248.263696][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 248.272855][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 248.428325][ T8380] fuse: Unknown parameter 'user_id00000000000000000000' [ 248.439131][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 248.448308][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 248.456983][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 248.466137][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 248.475131][ T109] loop2: unable to read partition table [ 248.497710][ T8384] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 248.500606][ T8384] rust_binder: Failed to allocate buffer. len:4152, is_oneway:true [ 248.509624][ T8384] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 248.509626][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 248.538711][ T8384] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1017 [ 248.558799][ T36] kauditd_printk_skb: 872 callbacks suppressed [ 248.558824][ T36] audit: type=1400 audit(1756941188.104:22947): avc: denied { read write } for pid=4271 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 248.604020][ T36] audit: type=1400 audit(1756941188.104:22948): avc: denied { read write open } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 248.629821][ T392] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 248.629824][ T36] audit: type=1400 audit(1756941188.104:22949): avc: denied { ioctl } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 248.629852][ T36] audit: type=1400 audit(1756941188.124:22950): avc: denied { ioctl } for pid=8374 comm="syz.8.3254" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 248.689218][ T36] audit: type=1400 audit(1756941188.204:22951): avc: denied { ioctl } for pid=8374 comm="syz.8.3254" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 248.715091][ T36] audit: type=1400 audit(1756941188.204:22952): avc: denied { ioctl } for pid=8374 comm="syz.8.3254" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 248.758260][ T8388] rust_binder: BC_REQUEST_FREEZE_NOTIFICATION invalid ref 1 [ 248.765627][ T36] audit: type=1400 audit(1756941188.204:22953): avc: denied { ioctl } for pid=8374 comm="syz.8.3254" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 248.779819][ T392] usb 9-1: device descriptor read/64, error -71 [ 248.791508][ T8388] rust_binder: Write failure EINVAL in pid:1021 [ 248.809808][ T36] audit: type=1400 audit(1756941188.204:22954): avc: denied { ioctl } for pid=8374 comm="syz.8.3254" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 248.873658][ T36] audit: type=1400 audit(1756941188.204:22955): avc: denied { ioctl } for pid=8374 comm="syz.8.3254" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 248.930543][ T36] audit: type=1400 audit(1756941188.204:22956): avc: denied { ioctl } for pid=8374 comm="syz.8.3254" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 249.007047][ T8399] netlink: 188 bytes leftover after parsing attributes in process `syz.7.3260'. [ 249.079863][ T392] usb 9-1: device descriptor read/64, error -71 [ 249.097624][ T8404] fuse: Unknown parameter 'user_id00000000000000000000' [ 249.188308][ T8407] rust_binder: Error while translating object. [ 249.188353][ T8407] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 249.195118][ T8407] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:1187 [ 249.263132][ T8412] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 249.298663][ T8415] FAULT_INJECTION: forcing a failure. [ 249.298663][ T8415] name failslab, interval 1, probability 0, space 0, times 0 [ 249.313295][ T8415] CPU: 0 UID: 0 PID: 8415 Comm: syz.1.3271 Not tainted syzkaller #0 ecd017b10525a6fce0a0b730885af6e9bd831db9 [ 249.313325][ T8415] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 249.313349][ T8415] Call Trace: [ 249.313356][ T8415] [ 249.313364][ T8415] __dump_stack+0x21/0x30 [ 249.313402][ T8415] dump_stack_lvl+0x10c/0x190 [ 249.313422][ T8415] ? __cfi_dump_stack_lvl+0x10/0x10 [ 249.313443][ T8415] ? pointer+0xdd0/0xdd0 [ 249.313466][ T8415] dump_stack+0x19/0x20 [ 249.313483][ T8415] should_fail_ex+0x3d9/0x530 [ 249.313506][ T8415] should_failslab+0xac/0x100 [ 249.313525][ T8415] __kmalloc_node_track_caller_noprof+0x68/0x440 [ 249.313552][ T8415] ? sidtab_sid2str_get+0x139/0x370 [ 249.313573][ T8415] kmemdup_noprof+0x31/0x80 [ 249.313597][ T8415] sidtab_sid2str_get+0x139/0x370 [ 249.313616][ T8415] security_sid_to_context_core+0x30d/0x5d0 [ 249.313634][ T8415] security_sid_to_context+0x2e/0x50 [ 249.313651][ T8415] avc_audit_post_callback+0x107/0x780 [ 249.313675][ T8415] ? audit_log_format+0xdb/0x140 [ 249.313696][ T8415] ? __cfi_avc_audit_post_callback+0x10/0x10 [ 249.313727][ T8415] ? __cfi_audit_log_format+0x10/0x10 [ 249.313749][ T8415] ? audit_log_untrustedstring+0xea/0x100 [ 249.313772][ T8415] ? __cfi_avc_audit_post_callback+0x10/0x10 [ 249.313795][ T8415] common_lsm_audit+0x147d/0x1860 [ 249.313816][ T8415] ? __cfi_avc_audit_post_callback+0x10/0x10 [ 249.313839][ T8415] ? __kasan_slab_free+0x6a/0x80 [ 249.313858][ T8415] ? __cfi_common_lsm_audit+0x10/0x10 [ 249.313880][ T8415] ? _raw_spin_lock_irqsave+0xaf/0x150 [ 249.313903][ T8415] ? avc_node_kill+0x29e/0x2f0 [ 249.313926][ T8415] ? __kasan_check_write+0x18/0x20 [ 249.313949][ T8415] ? avc_node_kill+0x2b6/0x2f0 [ 249.313972][ T8415] slow_avc_audit+0x18d/0x1f0 [ 249.313995][ T8415] ? __cfi_slow_avc_audit+0x10/0x10 [ 249.314018][ T8415] ? avc_has_perm_noaudit+0x2b9/0x360 [ 249.314042][ T8415] avc_has_perm+0x1cd/0x220 [ 249.314065][ T8415] ? __cfi_avc_has_perm+0x10/0x10 [ 249.314088][ T8415] ? __asan_memcpy+0x5a/0x80 [ 249.314111][ T8415] selinux_mount+0x39a/0x4e0 [ 249.314129][ T8415] ? __cfi_selinux_mount+0x10/0x10 [ 249.314147][ T8415] security_sb_mount+0x72/0x100 [ 249.314172][ T8415] path_mount+0xca/0x1050 [ 249.314188][ T8415] ? putname+0x113/0x150 [ 249.314206][ T8415] __se_sys_mount+0x2bd/0x480 [ 249.314223][ T8415] ? ksys_write+0x1ef/0x250 [ 249.314240][ T8415] ? __x64_sys_mount+0xf0/0xf0 [ 249.314258][ T8415] __x64_sys_mount+0xc3/0xf0 [ 249.314275][ T8415] x64_sys_call+0x2021/0x2ee0 [ 249.314299][ T8415] do_syscall_64+0x58/0xf0 [ 249.314321][ T8415] ? clear_bhb_loop+0x50/0xa0 [ 249.314342][ T8415] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 249.314362][ T8415] RIP: 0033:0x7f632358ebe9 [ 249.314383][ T8415] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 249.314399][ T8415] RSP: 002b:00007f6324453038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 249.314424][ T8415] RAX: ffffffffffffffda RBX: 00007f63237c5fa0 RCX: 00007f632358ebe9 [ 249.314438][ T8415] RDX: 0000200000000000 RSI: 0000200000000180 RDI: 0000000000000000 [ 249.314452][ T8415] RBP: 00007f6324453090 R08: 0000200000000040 R09: 0000000000000000 [ 249.314465][ T8415] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 249.314478][ T8415] R13: 00007f63237c6038 R14: 00007f63237c5fa0 R15: 00007ffe72787808 [ 249.314494][ T8415] [ 249.389832][ T392] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 249.411404][ T8419] rust_binder: Failed to allocate buffer. len:4160, is_oneway:true [ 249.580669][ T8423] fuse: Bad value for 'fd' [ 249.582132][ T8419] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 249.639852][ T392] usb 9-1: device descriptor read/64, error -71 [ 249.642920][ T8419] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1193 [ 249.899825][ T392] usb 9-1: device descriptor read/64, error -71 [ 249.911045][ T8439] netlink: 37 bytes leftover after parsing attributes in process `syz.1.3280'. [ 249.991706][ T8454] netlink: 188 bytes leftover after parsing attributes in process `syz.1.3282'. [ 250.049964][ T392] usb usb9-port1: attempt power cycle [ 250.097859][ T8465] rust_binder: Write failure EFAULT in pid:360 [ 250.119957][ T8467] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 250.170422][ T8467] rust_binder: Error in use_page_slow: ESRCH [ 250.195388][ T8467] rust_binder: use_range failure ESRCH [ 250.202392][ T8469] fuse: Bad value for 'fd' [ 250.207992][ T8467] rust_binder: Failed to allocate buffer. len:4232, is_oneway:false [ 250.212326][ T8467] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 250.229452][ T8467] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1041 [ 250.283181][ T8472] rust_binder: Error while translating object. [ 250.292412][ T8472] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 250.298631][ T8472] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:363 [ 250.400216][ T392] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 250.491773][ T392] usb 9-1: device descriptor read/8, error -71 [ 250.616364][ T8489] rust_binder: validate_parent_fixup: new_min_offset=18, sg_entry.length=0 [ 250.616381][ T8489] rust_binder: Error while translating object. [ 250.625063][ T8489] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 250.631602][ T8489] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:1228 [ 250.642449][ T392] usb 9-1: device descriptor read/8, error -71 [ 250.716642][ T8497] netlink: 188 bytes leftover after parsing attributes in process `syz.6.3296'. [ 250.779818][ T10] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 250.799506][ T8501] fuse: Bad value for 'fd' [ 250.889822][ T392] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 250.921142][ T392] usb 9-1: device descriptor read/8, error -71 [ 250.921358][ T8503] veth0: entered promiscuous mode [ 250.953557][ T10] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 250.968808][ T10] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 250.988224][ T10] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 250.998787][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 251.007428][ T10] usb 2-1: SerialNumber: syz [ 251.051838][ T392] usb 9-1: device descriptor read/8, error -71 [ 251.159902][ T392] usb usb9-port1: unable to enumerate USB device [ 251.224610][ T10] usb 2-1: 0:2 : does not exist [ 251.240178][ T10] usb 2-1: USB disconnect, device number 46 [ 251.321741][ T4863] udevd[4863]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 251.551504][ T8527] fuse: Unknown parameter '0x0000000000000003' [ 251.829555][ T8502] veth0: left promiscuous mode [ 252.027940][ T8554] rust_binder: Failed to allocate buffer. len:4376, is_oneway:true [ 252.027969][ T8554] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 252.035966][ T8554] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:345 [ 252.059810][ T331] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 252.108539][ T8555] fuse: Unknown parameter '0x0000000000000003' [ 252.229804][ T331] usb 2-1: Using ep0 maxpacket: 16 [ 252.239817][ T331] usb 2-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 252.261437][ T331] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 252.304847][ T331] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 252.328794][ T331] usb 2-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 252.375529][ T331] usb 2-1: config 7 interface 0 has no altsetting 0 [ 252.387929][ T8572] loop2: detected capacity change from 0 to 7 [ 252.388089][ T331] usb 2-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 252.410558][ T8572] loop2: unable to read partition table [ 252.410580][ T331] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 252.436135][ T8572] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 252.535845][ T8580] 9pnet_fd: Insufficient options for proto=fd [ 252.824586][ T8598] fuse: Unknown parameter '0x0000000000000003' [ 252.845585][ T331] input: HID 0458:5010 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:7.0/0003:0458:5010.0028/input/input27 [ 252.886852][ T331] kye 0003:0458:5010.0028: input,hiddev96,hidraw0: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.1-1/input0 [ 252.933264][ T8603] rust_binder: Failed to allocate buffer. len:12312, is_oneway:true [ 252.933293][ T8603] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 252.951516][ T8603] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:362 [ 253.059511][ T331] usb 2-1: USB disconnect, device number 47 [ 253.132480][ T8611] FAULT_INJECTION: forcing a failure. [ 253.132480][ T8611] name failslab, interval 1, probability 0, space 0, times 0 [ 253.145857][ T8611] CPU: 1 UID: 0 PID: 8611 Comm: syz.6.3341 Not tainted syzkaller #0 ecd017b10525a6fce0a0b730885af6e9bd831db9 [ 253.145889][ T8611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 253.145900][ T8611] Call Trace: [ 253.145907][ T8611] [ 253.145915][ T8611] __dump_stack+0x21/0x30 [ 253.145944][ T8611] dump_stack_lvl+0x10c/0x190 [ 253.145966][ T8611] ? __cfi_dump_stack_lvl+0x10/0x10 [ 253.145990][ T8611] dump_stack+0x19/0x20 [ 253.146011][ T8611] should_fail_ex+0x3d9/0x530 [ 253.146037][ T8611] should_failslab+0xac/0x100 [ 253.146056][ T8611] __kmalloc_cache_noprof+0x41/0x3c0 [ 253.146081][ T8611] ? ovl_init_fs_context+0xbc/0x720 [ 253.146099][ T8611] ovl_init_fs_context+0xbc/0x720 [ 253.146116][ T8611] alloc_fs_context+0x5ee/0x830 [ 253.146139][ T8611] fs_context_for_mount+0x26/0x40 [ 253.146160][ T8611] do_new_mount+0x116/0xb40 [ 253.146176][ T8611] ? security_capable+0xcf/0xf0 [ 253.146199][ T8611] path_mount+0x688/0x1050 [ 253.146215][ T8611] ? putname+0x113/0x150 [ 253.146233][ T8611] __se_sys_mount+0x2bd/0x480 [ 253.146250][ T8611] ? ksys_write+0x1ef/0x250 [ 253.146267][ T8611] ? __x64_sys_mount+0xf0/0xf0 [ 253.146286][ T8611] __x64_sys_mount+0xc3/0xf0 [ 253.146303][ T8611] x64_sys_call+0x2021/0x2ee0 [ 253.146324][ T8611] do_syscall_64+0x58/0xf0 [ 253.146343][ T8611] ? clear_bhb_loop+0x50/0xa0 [ 253.146362][ T8611] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 253.146380][ T8611] RIP: 0033:0x7f2215d8ebe9 [ 253.146396][ T8611] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 253.146411][ T8611] RSP: 002b:00007f2216cda038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 253.146432][ T8611] RAX: ffffffffffffffda RBX: 00007f2215fc5fa0 RCX: 00007f2215d8ebe9 [ 253.146446][ T8611] RDX: 0000200000000000 RSI: 0000200000000180 RDI: 0000000000000000 [ 253.146460][ T8611] RBP: 00007f2216cda090 R08: 0000200000000040 R09: 0000000000000000 [ 253.146473][ T8611] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 253.146485][ T8611] R13: 00007f2215fc6038 R14: 00007f2215fc5fa0 R15: 00007ffe2844ce88 [ 253.146501][ T8611] [ 253.199247][ T8614] rust_binder: Error while translating object. [ 253.229676][ T8615] rust_binder: Write failure EFAULT in pid:366 [ 253.231386][ T8614] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 253.375734][ T8614] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:401 [ 253.485178][ T8626] rust_binder: 1279: no such ref 1 [ 253.501963][ T8626] rust_binder: Write failure EFAULT in pid:1279 [ 253.575165][ T36] kauditd_printk_skb: 878 callbacks suppressed [ 253.575183][ T36] audit: type=1400 audit(1756941193.129:23835): avc: denied { read write } for pid=7125 comm="syz-executor" name="loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 253.652540][ T36] audit: type=1400 audit(1756941193.149:23836): avc: denied { read write } for pid=3451 comm="syz-executor" name="loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 253.662454][ T8643] FAULT_INJECTION: forcing a failure. [ 253.662454][ T8643] name failslab, interval 1, probability 0, space 0, times 0 [ 253.690328][ T8641] fuse: Unknown parameter '0x0000000000000003' [ 253.697770][ T8643] CPU: 0 UID: 0 PID: 8643 Comm: syz.1.3353 Not tainted syzkaller #0 ecd017b10525a6fce0a0b730885af6e9bd831db9 [ 253.697800][ T8643] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 253.697812][ T8643] Call Trace: [ 253.697819][ T8643] [ 253.697828][ T8643] __dump_stack+0x21/0x30 [ 253.697857][ T8643] dump_stack_lvl+0x10c/0x190 [ 253.697879][ T8643] ? __cfi_dump_stack_lvl+0x10/0x10 [ 253.697903][ T8643] dump_stack+0x19/0x20 [ 253.697924][ T8643] should_fail_ex+0x3d9/0x530 [ 253.697949][ T8643] should_failslab+0xac/0x100 [ 253.697969][ T8643] __kmalloc_cache_noprof+0x41/0x3c0 [ 253.697994][ T8643] ? ovl_init_fs_context+0x161/0x720 [ 253.698012][ T8643] ovl_init_fs_context+0x161/0x720 [ 253.698030][ T8643] alloc_fs_context+0x5ee/0x830 [ 253.698052][ T8643] fs_context_for_mount+0x26/0x40 [ 253.698073][ T8643] do_new_mount+0x116/0xb40 [ 253.698089][ T8643] ? security_capable+0xcf/0xf0 [ 253.698114][ T8643] path_mount+0x688/0x1050 [ 253.698130][ T8643] ? putname+0x113/0x150 [ 253.698148][ T8643] __se_sys_mount+0x2bd/0x480 [ 253.698163][ T8643] ? ksys_write+0x1ef/0x250 [ 253.698177][ T8643] ? __x64_sys_mount+0xf0/0xf0 [ 253.698194][ T8643] __x64_sys_mount+0xc3/0xf0 [ 253.698209][ T8643] x64_sys_call+0x2021/0x2ee0 [ 253.698241][ T8643] do_syscall_64+0x58/0xf0 [ 253.698263][ T8643] ? clear_bhb_loop+0x50/0xa0 [ 253.698284][ T8643] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 253.698304][ T8643] RIP: 0033:0x7f632358ebe9 [ 253.698320][ T8643] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 253.698336][ T8643] RSP: 002b:00007f6324453038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 253.698357][ T8643] RAX: ffffffffffffffda RBX: 00007f63237c5fa0 RCX: 00007f632358ebe9 [ 253.698372][ T8643] RDX: 0000200000000000 RSI: 0000200000000180 RDI: 0000000000000000 [ 253.698386][ T8643] RBP: 00007f6324453090 R08: 0000200000000040 R09: 0000000000000000 [ 253.698400][ T8643] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 253.698412][ T8643] R13: 00007f63237c6038 R14: 00007f63237c5fa0 R15: 00007ffe72787808 [ 253.698428][ T8643] [ 253.699803][ T36] audit: type=1400 audit(1756941193.149:23837): avc: denied { read write open } for pid=3451 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 254.037549][ T36] audit: type=1400 audit(1756941193.149:23838): avc: denied { ioctl } for pid=3451 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 254.120582][ T36] audit: type=1400 audit(1756941193.169:23839): avc: denied { read write open } for pid=7125 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 254.149714][ T36] audit: type=1400 audit(1756941193.169:23840): avc: denied { ioctl } for pid=7125 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 254.208724][ T36] audit: type=1400 audit(1756941193.179:23841): avc: denied { read write } for pid=4271 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 254.277107][ T36] audit: type=1400 audit(1756941193.179:23842): avc: denied { read write open } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 254.330636][ T36] audit: type=1400 audit(1756941193.179:23843): avc: denied { ioctl } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 254.372729][ T36] audit: type=1400 audit(1756941193.199:23844): avc: denied { create } for pid=8639 comm="syz.8.3351" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 254.467520][ T8663] netlink: 37 bytes leftover after parsing attributes in process `syz.1.3362'. [ 254.472917][ T8664] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 254.476498][ T8664] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:410 [ 254.529683][ T8668] fuse: Unknown parameter '0x0000000000000003' [ 254.599812][ T392] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 254.630062][ T8675] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 254.631603][ T8675] rust_binder: Failed to allocate buffer. len:45592, is_oneway:true [ 254.638313][ T8675] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 254.646425][ T8675] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1067 [ 254.699611][ T8679] tipc: Enabling of bearer rejected, failed to enable media [ 254.759845][ T392] usb 9-1: Using ep0 maxpacket: 32 [ 254.778983][ T8684] loop2: detected capacity change from 0 to 7 [ 254.782129][ T392] usb 9-1: config index 0 descriptor too short (expected 29220, got 36) [ 254.793460][ C1] blk_print_req_error: 13 callbacks suppressed [ 254.793476][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 254.808748][ C1] buffer_io_error: 11 callbacks suppressed [ 254.808764][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 254.826572][ T392] usb 9-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 254.835214][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 254.835245][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 254.835277][ T8684] loop2: unable to read partition table [ 254.835344][ T8684] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 254.850765][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 254.855044][ T8689] netlink: 37 bytes leftover after parsing attributes in process `syz.7.3372'. [ 254.860414][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 254.898775][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 254.906648][ T392] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 254.916238][ T392] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 254.926176][ T392] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 254.930159][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 254.936066][ T392] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 254.945150][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 254.968705][ T392] usb 9-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 254.978378][ T392] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 254.994244][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 255.003418][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 255.011962][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 255.021144][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 255.029305][ T8693] fuse: Unknown parameter '0x0000000000000003' [ 255.029785][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 255.044635][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 255.072277][ T392] usb 9-1: config 0 descriptor?? [ 255.282501][ T392] usblp 9-1:0.0: usblp0: USB Bidirectional printer dev 19 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 255.300007][ T392] usb 9-1: USB disconnect, device number 19 [ 255.308456][ T392] usblp0: removed [ 255.473995][ T8714] loop2: detected capacity change from 0 to 7 [ 255.480549][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 255.489715][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 255.498696][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 255.502913][ T8704] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:421 [ 255.507849][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 255.524829][ T8714] loop2: unable to read partition table [ 255.539865][ T8714] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 255.564439][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 255.646911][ T8719] fuse: Unknown parameter 'fd0x0000000000000003' [ 255.839814][ T392] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 255.953902][ T8735] /dev/rnullb0: Can't open blockdev [ 255.986692][ T8738] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 255.990429][ T392] usb 9-1: Using ep0 maxpacket: 32 [ 256.035039][ T392] usb 9-1: config index 0 descriptor too short (expected 29220, got 36) [ 256.041246][ T8742] netlink: 37 bytes leftover after parsing attributes in process `syz.6.3391'. [ 256.051659][ T392] usb 9-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 256.063152][ T8741] loop2: detected capacity change from 0 to 7 [ 256.071753][ T8741] loop2: unable to read partition table [ 256.077516][ T8741] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 256.088106][ T392] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 256.120168][ T392] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 256.148361][ T392] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 256.163039][ T392] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 256.176932][ T392] usb 9-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 256.186344][ T392] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 256.208563][ T392] usb 9-1: config 0 descriptor?? [ 256.282846][ T8748] __vm_enough_memory: pid: 8748, comm: syz.1.3396, bytes: 18014402804453376 not enough memory for the allocation [ 256.359813][ T9] usb 7-1: new high-speed USB device number 57 using dummy_hcd [ 256.412645][ T8757] overlayfs: unescaped trailing colons in lowerdir mount option. [ 256.430098][ T392] usblp 9-1:0.0: usblp0: USB Bidirectional printer dev 20 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 256.509977][ T9] usb 7-1: Using ep0 maxpacket: 16 [ 256.517121][ T9] usb 7-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 256.527864][ T9] usb 7-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 256.538762][ T9] usb 7-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 256.548521][ T9] usb 7-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 256.562288][ T9] usb 7-1: config 7 interface 0 has no altsetting 0 [ 256.579806][ T9] usb 7-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 256.599835][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 256.650487][ T331] usb 9-1: USB disconnect, device number 20 [ 256.659967][ T331] usblp0: removed [ 256.766103][ T8765] loop2: detected capacity change from 0 to 7 [ 256.772737][ T8765] loop2: unable to read partition table [ 256.778418][ T8765] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 256.910719][ T8767] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:1108 [ 257.046926][ T9] input: HID 0458:5010 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:7.0/0003:0458:5010.0029/input/input28 [ 257.101927][ T9] kye 0003:0458:5010.0029: input,hiddev96,hidraw0: USB HID v2.00 Device [HID 0458:5010] on usb-dummy_hcd.6-1/input0 [ 257.241702][ T9] usb 7-1: USB disconnect, device number 57 [ 257.446298][ T8787] loop2: detected capacity change from 0 to 7 [ 257.452831][ T8787] loop2: unable to read partition table [ 257.458562][ T8787] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 257.539394][ T8791] netlink: 37 bytes leftover after parsing attributes in process `syz.1.3413'. [ 257.674619][ T8800] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 257.680699][ T8800] rust_binder: Error in use_page_slow: ESRCH [ 257.687151][ T8800] rust_binder: use_range failure ESRCH [ 257.695399][ T8800] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 257.701796][ T8800] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 257.710328][ T8800] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1126 [ 257.834774][ T8811] loop2: detected capacity change from 0 to 7 [ 257.865732][ T8811] loop2: unable to read partition table [ 257.887214][ T8811] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 258.179729][ T8835] rust_binder: Read failure Err(EAGAIN) in pid:1139 [ 258.225768][ T8840] netlink: 37 bytes leftover after parsing attributes in process `syz.1.3431'. [ 258.247388][ T8838] loop2: detected capacity change from 0 to 7 [ 258.266823][ T8838] loop2: unable to read partition table [ 258.272447][ T8842] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 258.276501][ T8842] rust_binder: Error in use_page_slow: ESRCH [ 258.283652][ T8842] rust_binder: use_range failure ESRCH [ 258.284437][ T8838] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 258.289639][ T8842] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 258.289663][ T8842] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 258.326479][ T8842] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1144 [ 258.421328][ T8847] netlink: 188 bytes leftover after parsing attributes in process `syz.1.3433'. [ 258.588740][ T36] kauditd_printk_skb: 750 callbacks suppressed [ 258.588756][ T36] audit: type=1400 audit(1756941198.139:24595): avc: denied { read write } for pid=3451 comm="syz-executor" name="loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 258.625095][ T8859] rust_binder: Failed to allocate buffer. len:4152, is_oneway:true [ 258.625122][ T8859] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 258.643465][ T8859] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1344 [ 258.656940][ T36] audit: type=1400 audit(1756941198.139:24596): avc: denied { read write open } for pid=3451 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 258.714307][ T36] audit: type=1400 audit(1756941198.139:24597): avc: denied { ioctl } for pid=3451 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 258.740366][ T36] audit: type=1400 audit(1756941198.169:24598): avc: denied { read } for pid=8858 comm="syz.6.3439" name="binder1" dev="binder" ino=26 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 258.774060][ T8866] loop2: detected capacity change from 0 to 7 [ 258.780188][ T36] audit: type=1400 audit(1756941198.169:24599): avc: denied { read open } for pid=8858 comm="syz.6.3439" path="/dev/binderfs/binder1" dev="binder" ino=26 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 258.805614][ T36] audit: type=1400 audit(1756941198.179:24600): avc: denied { ioctl } for pid=8858 comm="syz.6.3439" path="/dev/binderfs/binder1" dev="binder" ino=26 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 258.805645][ T8866] loop2: unable to read partition table [ 258.838872][ T36] audit: type=1400 audit(1756941198.179:24601): avc: denied { set_context_mgr } for pid=8858 comm="syz.6.3439" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 258.859512][ T8866] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 258.880056][ T36] audit: type=1400 audit(1756941198.179:24602): avc: denied { map } for pid=8858 comm="syz.6.3439" path="/dev/binderfs/binder1" dev="binder" ino=26 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 258.937596][ T36] audit: type=1400 audit(1756941198.179:24603): avc: denied { read } for pid=8858 comm="syz.6.3439" path="/dev/binderfs/binder1" dev="binder" ino=26 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 259.019680][ T8873] netlink: 188 bytes leftover after parsing attributes in process `syz.1.3445'. [ 259.024203][ T36] audit: type=1400 audit(1756941198.179:24604): avc: denied { ioctl } for pid=8858 comm="syz.6.3439" path="/dev/binderfs/binder1" dev="binder" ino=26 ioctlcmd=0x6201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 259.212092][ T8885] rust_binder: Failed to allocate buffer. len:4160, is_oneway:true [ 259.212119][ T8885] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 259.226770][ T8885] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1355 [ 259.241299][ T8887] netlink: 37 bytes leftover after parsing attributes in process `syz.8.3452'. [ 259.371385][ T8898] rust_binder: Write failure EFAULT in pid:1171 [ 259.444268][ T8901] rust_binder: Error while translating object. [ 259.459826][ T8901] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 259.473328][ T8901] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:1361 [ 259.612449][ T8911] netlink: 'syz.1.3463': attribute type 4 has an invalid length. [ 259.633624][ T8911] netlink: 'syz.1.3463': attribute type 4 has an invalid length. [ 259.798565][ T8923] netlink: 37 bytes leftover after parsing attributes in process `syz.6.3470'. [ 259.920301][ T8934] FAULT_INJECTION: forcing a failure. [ 259.920301][ T8934] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 259.934779][ T8934] CPU: 0 UID: 0 PID: 8934 Comm: syz.6.3472 Not tainted syzkaller #0 ecd017b10525a6fce0a0b730885af6e9bd831db9 [ 259.934807][ T8934] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 259.934817][ T8934] Call Trace: [ 259.934823][ T8934] [ 259.934831][ T8934] __dump_stack+0x21/0x30 [ 259.934858][ T8934] dump_stack_lvl+0x10c/0x190 [ 259.934879][ T8934] ? __cfi_dump_stack_lvl+0x10/0x10 [ 259.934901][ T8934] dump_stack+0x19/0x20 [ 259.934921][ T8934] should_fail_ex+0x3d9/0x530 [ 259.934946][ T8934] should_fail+0xf/0x20 [ 259.934967][ T8934] should_fail_usercopy+0x1e/0x30 [ 259.934985][ T8934] _copy_to_iter+0x1a3/0x14b0 [ 259.935003][ T8934] ? seq_write+0xe3/0x140 [ 259.935024][ T8934] ? __cfi_fuse_show_options+0x10/0x10 [ 259.935045][ T8934] ? __virt_addr_valid+0x2a6/0x380 [ 259.935064][ T8934] ? __cfi__copy_to_iter+0x10/0x10 [ 259.935081][ T8934] ? __check_object_size+0x50a/0x810 [ 259.935098][ T8934] ? __cfi___check_object_size+0x10/0x10 [ 259.935116][ T8934] ? __kasan_check_write+0x18/0x20 [ 259.935138][ T8934] ? up_read+0x26/0x1d0 [ 259.935159][ T8934] seq_read_iter+0xd39/0xfe0 [ 259.935180][ T8934] vfs_read+0x540/0xb60 [ 259.935197][ T8934] ? __cfi_vfs_read+0x10/0x10 [ 259.935212][ T8934] ? __cfi_mutex_lock+0x10/0x10 [ 259.935232][ T8934] ksys_read+0x141/0x250 [ 259.935248][ T8934] ? __cfi_ksys_read+0x10/0x10 [ 259.935263][ T8934] ? __kasan_check_read+0x15/0x20 [ 259.935286][ T8934] __x64_sys_read+0x7f/0x90 [ 259.935300][ T8934] x64_sys_call+0x2638/0x2ee0 [ 259.935322][ T8934] do_syscall_64+0x58/0xf0 [ 259.935344][ T8934] ? clear_bhb_loop+0x50/0xa0 [ 259.935365][ T8934] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 259.935385][ T8934] RIP: 0033:0x7f2215d8ebe9 [ 259.935400][ T8934] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 259.935415][ T8934] RSP: 002b:00007f2216cda038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 259.935436][ T8934] RAX: ffffffffffffffda RBX: 00007f2215fc5fa0 RCX: 00007f2215d8ebe9 [ 259.935450][ T8934] RDX: 0000000000002020 RSI: 00002000000029c0 RDI: 0000000000000004 [ 259.935463][ T8934] RBP: 00007f2216cda090 R08: 0000000000000000 R09: 0000000000000000 [ 259.935475][ T8934] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 259.935488][ T8934] R13: 00007f2215fc6038 R14: 00007f2215fc5fa0 R15: 00007ffe2844ce88 [ 259.935504][ T8934] [ 260.179448][ T8938] rust_binder: Error while translating object. [ 260.179488][ T8938] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 260.186510][ T8938] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:428 [ 260.459806][ T355] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 260.618868][ T8971] netlink: 37 bytes leftover after parsing attributes in process `syz.8.3485'. [ 260.650399][ T355] usb 2-1: Using ep0 maxpacket: 16 [ 260.661545][ T355] usb 2-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 260.697990][ T355] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 260.721205][ T355] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 260.738621][ T355] usb 2-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 260.752313][ T355] usb 2-1: config 7 interface 0 has no altsetting 0 [ 260.761686][ T355] usb 2-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 260.771220][ T8977] overlayfs: unescaped trailing colons in lowerdir mount option. [ 260.780221][ T355] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 260.827813][ T8979] loop2: detected capacity change from 0 to 7 [ 260.840117][ C0] blk_print_req_error: 54 callbacks suppressed [ 260.840136][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 260.855470][ C0] buffer_io_error: 46 callbacks suppressed [ 260.855487][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 260.871717][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 260.880889][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 260.888374][ T8983] rust_binder: Error while translating object. [ 260.888717][ T8979] loop2: unable to read partition table [ 260.889504][ T8983] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 260.895634][ T8979] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 260.908225][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 260.910794][ T8983] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:434 [ 260.923332][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 260.928669][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 260.958506][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 260.968507][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 260.977691][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 260.994885][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 261.004059][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 261.016490][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 261.025658][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 261.029815][ T331] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 261.064358][ T8988] FAULT_INJECTION: forcing a failure. [ 261.064358][ T8988] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 261.077511][ T8988] CPU: 0 UID: 0 PID: 8988 Comm: syz.6.3491 Not tainted syzkaller #0 ecd017b10525a6fce0a0b730885af6e9bd831db9 [ 261.077540][ T8988] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 261.077551][ T8988] Call Trace: [ 261.077559][ T8988] [ 261.077566][ T8988] __dump_stack+0x21/0x30 [ 261.077604][ T8988] dump_stack_lvl+0x10c/0x190 [ 261.077624][ T8988] ? __cfi_dump_stack_lvl+0x10/0x10 [ 261.077647][ T8988] ? check_stack_object+0x12c/0x140 [ 261.077665][ T8988] dump_stack+0x19/0x20 [ 261.077686][ T8988] should_fail_ex+0x3d9/0x530 [ 261.077711][ T8988] should_fail+0xf/0x20 [ 261.077734][ T8988] should_fail_usercopy+0x1e/0x30 [ 261.077751][ T8988] _copy_to_user+0x24/0xa0 [ 261.077771][ T8988] simple_read_from_buffer+0xed/0x160 [ 261.077789][ T8988] proc_fail_nth_read+0x19e/0x210 [ 261.077810][ T8988] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 261.077832][ T8988] ? bpf_lsm_file_permission+0xd/0x20 [ 261.077854][ T8988] ? __cfi_proc_fail_nth_read+0x10/0x10 [ 261.077877][ T8988] vfs_read+0x27b/0xb60 [ 261.077894][ T8988] ? __cfi_vfs_read+0x10/0x10 [ 261.077910][ T8988] ? __kasan_check_write+0x18/0x20 [ 261.077933][ T8988] ? mutex_lock+0x92/0x1c0 [ 261.077952][ T8988] ? __cfi_mutex_lock+0x10/0x10 [ 261.077970][ T8988] ? __fget_files+0x2c5/0x340 [ 261.077990][ T8988] ksys_read+0x141/0x250 [ 261.078007][ T8988] ? __cfi_ksys_read+0x10/0x10 [ 261.078025][ T8988] ? __kasan_check_read+0x15/0x20 [ 261.078049][ T8988] __x64_sys_read+0x7f/0x90 [ 261.078066][ T8988] x64_sys_call+0x2638/0x2ee0 [ 261.078089][ T8988] do_syscall_64+0x58/0xf0 [ 261.078112][ T8988] ? clear_bhb_loop+0x50/0xa0 [ 261.078133][ T8988] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 261.078154][ T8988] RIP: 0033:0x7f2215d8d5fc [ 261.078169][ T8988] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 261.078185][ T8988] RSP: 002b:00007f2216cda030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 261.078206][ T8988] RAX: ffffffffffffffda RBX: 00007f2215fc5fa0 RCX: 00007f2215d8d5fc [ 261.078221][ T8988] RDX: 000000000000000f RSI: 00007f2216cda0a0 RDI: 0000000000000005 [ 261.078233][ T8988] RBP: 00007f2216cda090 R08: 0000000000000000 R09: 0000000000000000 [ 261.078244][ T8988] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 261.078255][ T8988] R13: 00007f2215fc6038 R14: 00007f2215fc5fa0 R15: 00007ffe2844ce88 [ 261.078269][ T8988] [ 261.321652][ T355] usbhid 2-1:7.0: can't add hid device: -71 [ 261.327617][ T355] usbhid 2-1:7.0: probe with driver usbhid failed with error -71 [ 261.336310][ T355] usb 2-1: USB disconnect, device number 48 [ 261.355335][ T8990] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3493'. [ 261.392033][ T331] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 261.402959][ T331] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 261.412734][ T331] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 261.425806][ T331] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 261.435201][ T331] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 261.448089][ T331] usb 9-1: config 0 descriptor?? [ 261.505916][ T8996] rust_binder: Failed to allocate buffer. len:4376, is_oneway:true [ 261.505944][ T8996] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 261.513968][ T8996] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:440 [ 261.664019][ T9003] loop2: detected capacity change from 0 to 7 [ 261.679637][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 261.688801][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 261.739907][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 261.749066][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 261.761733][ T9003] loop2: unable to read partition table [ 261.767455][ T9003] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 261.781649][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 261.790819][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 261.829363][ T9014] netlink: 37 bytes leftover after parsing attributes in process `syz.6.3504'. [ 261.890931][ T331] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 261.906094][ T331] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 261.913831][ T331] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 261.924968][ T331] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 261.934981][ T331] plantronics 0003:047F:FFFF.002A: unknown main item tag 0x0 [ 261.953707][ T331] plantronics 0003:047F:FFFF.002A: No inputs registered, leaving [ 262.001009][ T331] plantronics 0003:047F:FFFF.002A: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 262.191794][ T844] usb 9-1: USB disconnect, device number 21 [ 262.235168][ T9026] fido_id[9026]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 262.321344][ T9041] pim6reg1: entered promiscuous mode [ 262.326681][ T9041] pim6reg1: entered allmulticast mode [ 262.539810][ T392] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 262.689803][ T392] usb 2-1: Using ep0 maxpacket: 16 [ 262.701038][ T392] usb 2-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 262.712123][ T392] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 262.723897][ T392] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 262.739419][ T392] usb 2-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 262.784475][ T392] usb 2-1: config 7 interface 0 has no altsetting 0 [ 262.792472][ T392] usb 2-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 262.802323][ T392] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 262.811381][ T9066] overlayfs: conflicting options: nfs_export=on,index=off [ 262.821769][ T9068] overlayfs: unescaped trailing colons in lowerdir mount option. [ 263.158571][ T9085] overlayfs: unescaped trailing colons in lowerdir mount option. [ 263.230503][ T392] usbhid 2-1:7.0: can't add hid device: -71 [ 263.236483][ T392] usbhid 2-1:7.0: probe with driver usbhid failed with error -71 [ 263.246154][ T392] usb 2-1: USB disconnect, device number 49 [ 263.409840][ T331] usb 9-1: new high-speed USB device number 22 using dummy_hcd [ 263.593927][ T36] kauditd_printk_skb: 956 callbacks suppressed [ 263.593944][ T36] audit: type=1400 audit(1756941203.149:25561): avc: denied { ioctl } for pid=9084 comm="syz.8.3534" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 263.595557][ T331] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 263.600242][ T36] audit: type=1400 audit(1756941203.149:25562): avc: denied { ioctl } for pid=9084 comm="syz.8.3534" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 263.600267][ T36] audit: type=1400 audit(1756941203.149:25563): avc: denied { ioctl } for pid=9084 comm="syz.8.3534" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 263.600289][ T36] audit: type=1400 audit(1756941203.149:25564): avc: denied { ioctl } for pid=9084 comm="syz.8.3534" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 263.627557][ T331] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 263.637125][ T36] audit: type=1400 audit(1756941203.149:25565): avc: denied { ioctl } for pid=9084 comm="syz.8.3534" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5503 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 263.662456][ T331] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 263.686234][ T36] audit: type=1400 audit(1756941203.179:25566): avc: denied { ioctl } for pid=9084 comm="syz.8.3534" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 263.711806][ T331] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 263.739487][ T36] audit: type=1400 audit(1756941203.289:25567): avc: denied { mounton } for pid=9100 comm="syz.6.3540" path="/595/file0/file0" dev="fuse" ino=0 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=chr_file permissive=1 [ 263.745665][ T331] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 263.794355][ T36] audit: type=1400 audit(1756941203.349:25568): avc: denied { read write } for pid=4271 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 263.831189][ T331] usb 9-1: config 0 descriptor?? [ 263.850066][ T36] audit: type=1400 audit(1756941203.349:25569): avc: denied { read write open } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 263.884662][ T36] audit: type=1400 audit(1756941203.349:25570): avc: denied { ioctl } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 264.029423][ T9107] rust_binder: Failed to allocate buffer. len:65560, is_oneway:true [ 264.029451][ T9107] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 264.038272][ T9109] overlayfs: unescaped trailing colons in lowerdir mount option. [ 264.048204][ T9107] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1461 [ 264.308845][ T331] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 264.334446][ T331] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 264.342002][ T331] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 264.349447][ T331] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 264.360202][ T331] plantronics 0003:047F:FFFF.002B: unknown main item tag 0x0 [ 264.367829][ T331] plantronics 0003:047F:FFFF.002B: No inputs registered, leaving [ 264.382223][ T9117] bridge0: port 1(bridge_slave_0) entered blocking state [ 264.389264][ T9117] bridge0: port 1(bridge_slave_0) entered disabled state [ 264.392429][ T331] plantronics 0003:047F:FFFF.002B: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 264.398028][ T9117] bridge_slave_0: entered allmulticast mode [ 264.425531][ T9117] bridge_slave_0: entered promiscuous mode [ 264.432834][ T9117] bridge0: port 2(bridge_slave_1) entered blocking state [ 264.439931][ T9117] bridge0: port 2(bridge_slave_1) entered disabled state [ 264.447050][ T9117] bridge_slave_1: entered allmulticast mode [ 264.453413][ T9117] bridge_slave_1: entered promiscuous mode [ 264.544929][ T9117] bridge0: port 2(bridge_slave_1) entered blocking state [ 264.551997][ T9117] bridge0: port 2(bridge_slave_1) entered forwarding state [ 264.559230][ T9117] bridge0: port 1(bridge_slave_0) entered blocking state [ 264.566277][ T9117] bridge0: port 1(bridge_slave_0) entered forwarding state [ 264.574207][ T331] usb 9-1: USB disconnect, device number 22 [ 264.637356][ T1494] bridge0: port 1(bridge_slave_0) entered disabled state [ 264.647043][ T1494] bridge0: port 2(bridge_slave_1) entered disabled state [ 264.678232][ T1494] bridge0: port 1(bridge_slave_0) entered blocking state [ 264.685315][ T1494] bridge0: port 1(bridge_slave_0) entered forwarding state [ 264.695777][ T1494] bridge0: port 2(bridge_slave_1) entered blocking state [ 264.702845][ T1494] bridge0: port 2(bridge_slave_1) entered forwarding state [ 264.777675][ T9117] veth0_vlan: entered promiscuous mode [ 264.804552][ T9117] veth1_macvtap: entered promiscuous mode [ 264.959818][ T844] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 265.119818][ T844] usb 2-1: Using ep0 maxpacket: 16 [ 265.132818][ T844] usb 2-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 265.150866][ T844] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 265.175434][ T844] usb 2-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 265.199797][ T844] usb 2-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 265.230905][ T844] usb 2-1: config 7 interface 0 has no altsetting 0 [ 265.237559][ T844] usb 2-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 265.247646][ T844] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 265.315096][ T9143] FAULT_INJECTION: forcing a failure. [ 265.315096][ T9143] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 265.328300][ T9143] CPU: 0 UID: 0 PID: 9143 Comm: syz.8.3553 Not tainted syzkaller #0 ecd017b10525a6fce0a0b730885af6e9bd831db9 [ 265.328329][ T9143] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 265.328341][ T9143] Call Trace: [ 265.328348][ T9143] [ 265.328356][ T9143] __dump_stack+0x21/0x30 [ 265.328383][ T9143] dump_stack_lvl+0x10c/0x190 [ 265.328405][ T9143] ? __cfi_dump_stack_lvl+0x10/0x10 [ 265.328428][ T9143] ? avc_xperms_populate+0x292/0x620 [ 265.328459][ T9143] dump_stack+0x19/0x20 [ 265.328480][ T9143] should_fail_ex+0x3d9/0x530 [ 265.328503][ T9143] should_fail+0xf/0x20 [ 265.328524][ T9143] should_fail_usercopy+0x1e/0x30 [ 265.328552][ T9143] _copy_to_iter+0x56e/0x14b0 [ 265.328575][ T9143] ? __cfi__copy_to_iter+0x10/0x10 [ 265.328589][ T9143] ? __check_object_size+0x50a/0x810 [ 265.328600][ T9143] ? __cfi___check_object_size+0x10/0x10 [ 265.328613][ T9143] ? __skb_try_recv_datagram+0x3df/0x4e0 [ 265.328636][ T9143] __skb_datagram_iter+0x103/0x930 [ 265.328661][ T9143] ? __cfi_simple_copy_to_iter+0x10/0x10 [ 265.328687][ T9143] skb_copy_datagram_iter+0x44/0x160 [ 265.328707][ T9143] netlink_recvmsg+0x2c5/0xdf0 [ 265.328718][ T9143] ? __cfi_netlink_recvmsg+0x10/0x10 [ 265.328729][ T9143] ? bpf_lsm_socket_recvmsg+0xd/0x20 [ 265.328741][ T9143] ? security_socket_recvmsg+0x3a/0xf0 [ 265.328751][ T9143] ? __cfi_netlink_recvmsg+0x10/0x10 [ 265.328760][ T9143] sock_recvmsg+0x219/0x270 [ 265.328782][ T9143] ____sys_recvmsg+0x1ca/0x460 [ 265.328803][ T9143] ? __sys_recvmsg_sock+0x60/0x60 [ 265.328823][ T9143] ? import_iovec+0x81/0xb0 [ 265.328843][ T9143] ___sys_recvmsg+0x1b6/0x510 [ 265.328853][ T9143] ? __sys_recvmsg+0x280/0x280 [ 265.328863][ T9143] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 265.328877][ T9143] ? selinux_file_permission+0x309/0xb30 [ 265.328890][ T9143] ? __fget_files+0x2c5/0x340 [ 265.328901][ T9143] do_recvmmsg+0x326/0x770 [ 265.328916][ T9143] ? __sys_recvmmsg+0x290/0x290 [ 265.328935][ T9143] ? __cfi_vfs_write+0x10/0x10 [ 265.328954][ T9143] ? fput+0x1a5/0x240 [ 265.328975][ T9143] __x64_sys_recvmmsg+0x191/0x240 [ 265.328990][ T9143] ? __cfi___x64_sys_recvmmsg+0x10/0x10 [ 265.329000][ T9143] ? __kasan_check_read+0x15/0x20 [ 265.329014][ T9143] x64_sys_call+0x292c/0x2ee0 [ 265.329028][ T9143] do_syscall_64+0x58/0xf0 [ 265.329042][ T9143] ? clear_bhb_loop+0x50/0xa0 [ 265.329060][ T9143] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 265.329080][ T9143] RIP: 0033:0x7fd83eb8ebe9 [ 265.329096][ T9143] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 265.329111][ T9143] RSP: 002b:00007fd83fabf038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 265.329130][ T9143] RAX: ffffffffffffffda RBX: 00007fd83edc5fa0 RCX: 00007fd83eb8ebe9 [ 265.329138][ T9143] RDX: 0000000000000007 RSI: 0000200000001b40 RDI: 0000000000000003 [ 265.329145][ T9143] RBP: 00007fd83fabf090 R08: 0000000000000000 R09: 0000000000000000 [ 265.329152][ T9143] R10: 0000000040000100 R11: 0000000000000246 R12: 0000000000000001 [ 265.329159][ T9143] R13: 00007fd83edc6038 R14: 00007fd83edc5fa0 R15: 00007ffeec590058 [ 265.329167][ T9143] [ 265.658489][ T9147] overlayfs: unescaped trailing colons in lowerdir mount option. [ 265.670326][ T844] usbhid 2-1:7.0: can't add hid device: -71 [ 265.676777][ T844] usbhid 2-1:7.0: probe with driver usbhid failed with error -71 [ 265.720289][ T844] usb 2-1: USB disconnect, device number 50 [ 265.823649][ T9151] rust_binder: Failed to allocate buffer. len:4294967320, is_oneway:true [ 265.823678][ T9151] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 265.832242][ T9151] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:479 [ 265.877682][ T9153] overlayfs: unescaped trailing colons in lowerdir mount option. [ 266.024162][ T9157] loop2: detected capacity change from 0 to 7 [ 266.034061][ C1] blk_print_req_error: 4 callbacks suppressed [ 266.034079][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 266.049303][ C1] buffer_io_error: 4 callbacks suppressed [ 266.049323][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 266.063010][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 266.072201][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 266.080128][ T9157] loop2: unable to read partition table [ 266.085943][ T9157] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 266.100321][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 266.109460][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 266.118074][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 266.127233][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 266.137717][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 266.146874][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 266.156109][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 266.165283][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 266.189816][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 266.198973][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 266.309136][ T9166] netlink: 37 bytes leftover after parsing attributes in process `syz.8.3563'. [ 266.472925][ T9174] loop2: detected capacity change from 0 to 7 [ 266.479753][ T9177] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 266.479814][ T9177] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:492 [ 266.490482][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 266.508753][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 266.519889][ C1] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 266.529047][ C1] Buffer I/O error on dev loop2, logical block 0, async page read [ 266.538969][ T9174] loop2: unable to read partition table [ 266.561650][ T9174] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 266.674260][ C0] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0 [ 266.683472][ C0] Buffer I/O error on dev loop2, logical block 0, async page read [ 266.863977][ T9199] netlink: 37 bytes leftover after parsing attributes in process `syz.1.3579'. [ 266.921214][ T9201] cannot load conntrack support for proto=3 [ 266.991296][ T9207] /dev/rnullb0: Can't open blockdev [ 267.102398][ T9212] loop2: detected capacity change from 0 to 7 [ 267.112425][ T9212] loop2: unable to read partition table [ 267.118130][ T9212] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 267.376373][ T9223] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 267.376401][ T9223] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 267.388213][ T9223] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:34 [ 267.398394][ T9223] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 267.408120][ T9223] rust_binder: Read failure Err(EFAULT) in pid:34 [ 267.445081][ T9225] rust_binder: Error while translating object. [ 267.451637][ T9225] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 267.457809][ T9225] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:36 [ 267.615913][ T9235] fuse: Unknown parameter '0x0000000000000005' [ 267.646591][ T9237] loop2: detected capacity change from 0 to 7 [ 267.656030][ T9237] loop2: unable to read partition table [ 267.669623][ T9237] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 267.710241][ T9240] FAULT_INJECTION: forcing a failure. [ 267.710241][ T9240] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 267.747025][ T9240] CPU: 1 UID: 0 PID: 9240 Comm: syz.8.3593 Not tainted syzkaller #0 ecd017b10525a6fce0a0b730885af6e9bd831db9 [ 267.747060][ T9240] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 267.747072][ T9240] Call Trace: [ 267.747078][ T9240] [ 267.747086][ T9240] __dump_stack+0x21/0x30 [ 267.747114][ T9240] dump_stack_lvl+0x10c/0x190 [ 267.747136][ T9240] ? __cfi_dump_stack_lvl+0x10/0x10 [ 267.747160][ T9240] dump_stack+0x19/0x20 [ 267.747181][ T9240] should_fail_ex+0x3d9/0x530 [ 267.747205][ T9240] should_fail_alloc_page+0xeb/0x110 [ 267.747228][ T9240] __alloc_pages_noprof+0x19b/0x7b0 [ 267.747250][ T9240] ? __cfi___alloc_pages_noprof+0x10/0x10 [ 267.747273][ T9240] ? is_bpf_text_address+0x17b/0x1a0 [ 267.747293][ T9240] ? kernel_text_address+0xa9/0xe0 [ 267.747315][ T9240] ? unwind_get_return_address+0x51/0x90 [ 267.747335][ T9240] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 267.747359][ T9240] __folio_alloc_noprof+0x14/0x80 [ 267.747378][ T9240] folio_prealloc+0x46/0x240 [ 267.747395][ T9240] do_pte_missing+0x164c/0x4240 [ 267.747415][ T9240] ? stack_depot_save_flags+0x38/0x800 [ 267.747431][ T9240] ? pte_marker_clear+0x1b0/0x1b0 [ 267.747449][ T9240] ? __kasan_record_aux_stack+0xb2/0xd0 [ 267.747470][ T9240] ? kasan_record_aux_stack_noalloc+0xf/0x20 [ 267.747492][ T9240] ? __call_rcu_common+0xd5/0x700 [ 267.747509][ T9240] ? call_rcu+0x14/0x20 [ 267.747524][ T9240] ? __kasan_check_write+0x18/0x20 [ 267.747548][ T9240] ? _raw_spin_lock+0x8c/0x120 [ 267.747571][ T9240] ? __pte_offset_map+0x1b0/0x230 [ 267.747595][ T9240] ? pte_offset_map_rw_nolock+0xba/0x110 [ 267.747618][ T9240] handle_mm_fault+0x1166/0x1b90 [ 267.747640][ T9240] ? __cfi_handle_mm_fault+0x10/0x10 [ 267.747658][ T9240] ? find_vma+0xcd/0x110 [ 267.747676][ T9240] ? lock_mm_and_find_vma+0xb8/0x3a0 [ 267.747695][ T9240] do_user_addr_fault+0x4ca/0x1200 [ 267.747721][ T9240] exc_page_fault+0x59/0xc0 [ 267.747740][ T9240] asm_exc_page_fault+0x2b/0x30 [ 267.747759][ T9240] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 267.747782][ T9240] Code: 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb c9 a4 e9 bf 5d 03 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 267.747798][ T9240] RSP: 0018:ffffc90006c2f4b8 EFLAGS: 00050206 [ 267.747815][ T9240] RAX: 0000000000000101 RBX: ffff8881329001bc RCX: 00000000000009ec [ 267.747829][ T9240] RDX: 0000000000000000 RSI: ffff8881329001bc RDI: 0000200000003500 [ 267.747843][ T9240] RBP: ffffc90006c2f610 R08: ffff888132900ba7 R09: 1ffff11026520174 [ 267.747858][ T9240] R10: dffffc0000000000 R11: ffffed1026520175 R12: 0000200000003eec [ 267.747872][ T9240] R13: 00000000000009ec R14: 00007ffffffff000 R15: ffffc90006c2fd48 [ 267.747889][ T9240] ? _copy_to_iter+0x5ef/0x14b0 [ 267.747917][ T9240] ? __cfi__copy_to_iter+0x10/0x10 [ 267.747933][ T9240] ? __check_object_size+0x50a/0x810 [ 267.747950][ T9240] ? __cfi___check_object_size+0x10/0x10 [ 267.747966][ T9240] ? __skb_try_recv_datagram+0x3df/0x4e0 [ 267.747989][ T9240] __skb_datagram_iter+0x103/0x930 [ 267.748012][ T9240] ? __cfi_simple_copy_to_iter+0x10/0x10 [ 267.748038][ T9240] skb_copy_datagram_iter+0x44/0x160 [ 267.748066][ T9240] netlink_recvmsg+0x2c5/0xdf0 [ 267.748085][ T9240] ? __cfi_netlink_recvmsg+0x10/0x10 [ 267.748105][ T9240] ? bpf_lsm_socket_recvmsg+0xd/0x20 [ 267.748126][ T9240] ? security_socket_recvmsg+0x3a/0xf0 [ 267.748144][ T9240] ? __cfi_netlink_recvmsg+0x10/0x10 [ 267.748160][ T9240] sock_recvmsg+0x219/0x270 [ 267.748182][ T9240] ____sys_recvmsg+0x1ca/0x460 [ 267.748201][ T9240] ? __sys_recvmsg_sock+0x60/0x60 [ 267.748222][ T9240] ? import_iovec+0x81/0xb0 [ 267.748243][ T9240] ___sys_recvmsg+0x1b6/0x510 [ 267.748262][ T9240] ? __sys_recvmsg+0x280/0x280 [ 267.748281][ T9240] ? __cfi_kstrtouint_from_user+0x10/0x10 [ 267.748305][ T9240] ? selinux_file_permission+0x309/0xb30 [ 267.748326][ T9240] ? __fget_files+0x2c5/0x340 [ 267.748344][ T9240] do_recvmmsg+0x326/0x770 [ 267.748364][ T9240] ? __sys_recvmmsg+0x290/0x290 [ 267.748382][ T9240] ? __cfi_vfs_write+0x10/0x10 [ 267.748401][ T9240] ? fput+0x1a5/0x240 [ 267.748422][ T9240] __x64_sys_recvmmsg+0x191/0x240 [ 267.748441][ T9240] ? __cfi___x64_sys_recvmmsg+0x10/0x10 [ 267.748460][ T9240] ? __kasan_check_read+0x15/0x20 [ 267.748485][ T9240] x64_sys_call+0x292c/0x2ee0 [ 267.748510][ T9240] do_syscall_64+0x58/0xf0 [ 267.748532][ T9240] ? clear_bhb_loop+0x50/0xa0 [ 267.748553][ T9240] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 267.748573][ T9240] RIP: 0033:0x7fd83eb8ebe9 [ 267.748589][ T9240] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 267.748604][ T9240] RSP: 002b:00007fd83fabf038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 267.748623][ T9240] RAX: ffffffffffffffda RBX: 00007fd83edc5fa0 RCX: 00007fd83eb8ebe9 [ 267.748637][ T9240] RDX: 0000000000000007 RSI: 0000200000001b40 RDI: 0000000000000003 [ 267.748650][ T9240] RBP: 00007fd83fabf090 R08: 0000000000000000 R09: 0000000000000000 [ 267.748663][ T9240] R10: 0000000040000100 R11: 0000000000000246 R12: 0000000000000001 [ 267.748675][ T9240] R13: 00007fd83edc6038 R14: 00007fd83edc5fa0 R15: 00007ffeec590058 [ 267.748692][ T9240] [ 268.310679][ T9246] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 268.326670][ T9248] netlink: 37 bytes leftover after parsing attributes in process `syz.6.3594'. [ 268.446603][ T9254] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 268.448907][ T9254] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 268.455463][ T9254] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 268.479877][ T9254] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1227 [ 268.498970][ T9254] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 268.508874][ T9254] rust_binder: Read failure Err(EFAULT) in pid:1227 [ 268.549215][ T9260] loop2: detected capacity change from 0 to 7 [ 268.562446][ T9260] loop2: unable to read partition table [ 268.568138][ T9260] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 268.604182][ T36] kauditd_printk_skb: 776 callbacks suppressed [ 268.604198][ T36] audit: type=1400 audit(1756941208.139:26347): avc: denied { mounton } for pid=9259 comm="syz.1.3602" path="/510/bus" dev="tmpfs" ino=2761 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 268.633894][ T36] audit: type=1400 audit(1756941208.149:26348): avc: denied { unlink } for pid=9259 comm="syz.1.3602" name="#41" dev="tmpfs" ino=2768 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 268.659434][ T36] audit: type=1400 audit(1756941208.149:26349): avc: denied { mount } for pid=9259 comm="syz.1.3602" name="/" dev="overlay" ino=2762 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 268.692286][ T36] audit: type=1400 audit(1756941208.209:26350): avc: denied { unmount } for pid=4271 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 268.712588][ T36] audit: type=1400 audit(1756941208.249:26351): avc: denied { read write } for pid=4271 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 268.739112][ T36] audit: type=1400 audit(1756941208.249:26352): avc: denied { read write open } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 268.765049][ T36] audit: type=1400 audit(1756941208.249:26353): avc: denied { ioctl } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 268.790760][ T36] audit: type=1400 audit(1756941208.319:26354): avc: denied { read write } for pid=9263 comm="syz.1.3603" name="binder1" dev="binder" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 268.814189][ T36] audit: type=1400 audit(1756941208.319:26355): avc: denied { read write open } for pid=9263 comm="syz.1.3603" path="/dev/binderfs/binder1" dev="binder" ino=17 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 268.839497][ T36] audit: type=1400 audit(1756941208.319:26356): avc: denied { read write } for pid=9263 comm="syz.1.3603" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 268.999860][ T424] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 269.116548][ T9276] rust_binder: Failed to allocate buffer. len:4248, is_oneway:true [ 269.116577][ T9276] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 269.124624][ T9276] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:460 [ 269.149892][ T424] usb 2-1: Using ep0 maxpacket: 8 [ 269.182880][ T424] usb 2-1: unable to get BOS descriptor or descriptor too short [ 269.189672][ T9279] loop2: detected capacity change from 0 to 7 [ 269.193268][ T424] usb 2-1: config 6 has an invalid interface number: 215 but max is 0 [ 269.206318][ T424] usb 2-1: config 6 has no interface number 0 [ 269.206368][ T4863] loop2: unable to read partition table [ 269.206392][ T424] usb 2-1: config 6 interface 215 altsetting 5 endpoint 0xB has invalid maxpacket 1999, setting to 1024 [ 269.230643][ T424] usb 2-1: config 6 interface 215 altsetting 5 bulk endpoint 0xB has invalid maxpacket 1024 [ 269.233993][ T9279] loop2: unable to read partition table [ 269.241533][ T424] usb 2-1: config 6 interface 215 altsetting 5 bulk endpoint 0x6 has invalid maxpacket 64 [ 269.246635][ T9279] loop_reread_partitions: partition scan of loop2 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 269.272159][ T424] usb 2-1: config 6 interface 215 has no altsetting 0 [ 269.287773][ T424] usb 2-1: New USB device found, idVendor=0c52, idProduct=2442, bcdDevice=f8.3f [ 269.327243][ T424] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.339843][ T844] usb 7-1: new high-speed USB device number 58 using dummy_hcd [ 269.347501][ T424] usb 2-1: Product: syz [ 269.357597][ T424] usb 2-1: Manufacturer: syz [ 269.364267][ T424] usb 2-1: SerialNumber: syz [ 269.372800][ T9264] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 269.390139][ T9264] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 269.434847][ T9287] overlayfs: unescaped trailing colons in lowerdir mount option. [ 269.499823][ T844] usb 7-1: Using ep0 maxpacket: 16 [ 269.505821][ T9293] netlink: 188 bytes leftover after parsing attributes in process `syz.7.3616'. [ 269.508154][ T844] usb 7-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 269.525457][ T844] usb 7-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 269.536419][ T844] usb 7-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 269.546213][ T844] usb 7-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 269.559073][ T844] usb 7-1: config 7 interface 0 has no altsetting 0 [ 269.566319][ T844] usb 7-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 269.575467][ T844] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 269.579595][ T9297] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 269.583475][ T9297] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 269.592165][ T9297] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:474 [ 269.605392][ T9297] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 269.606136][ T424] ftdi_sio 2-1:6.215: FTDI USB Serial Device converter detected [ 269.615717][ T9297] rust_binder: Read failure Err(EFAULT) in pid:474 [ 269.640889][ T424] ftdi_sio ttyUSB0: unknown device type: 0xf83f [ 269.674132][ T424] usb 2-1: USB disconnect, device number 51 [ 269.684625][ T424] ftdi_sio 2-1:6.215: device disconnected [ 269.690446][ T392] usb 9-1: new high-speed USB device number 23 using dummy_hcd [ 269.800734][ T9303] cannot load conntrack support for proto=3 [ 269.841724][ T392] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 269.852701][ T392] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 269.863581][ T392] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 269.876809][ T392] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 269.885994][ T392] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 269.897947][ T392] usb 9-1: config 0 descriptor?? [ 269.998892][ T844] usbhid 7-1:7.0: can't add hid device: -71 [ 270.008655][ T844] usbhid 7-1:7.0: probe with driver usbhid failed with error -71 [ 270.017829][ T844] usb 7-1: USB disconnect, device number 58 [ 270.154948][ T9311] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 270.162220][ T9311] IPv6: NLM_F_CREATE should be set when creating new route [ 270.169425][ T9311] IPv6: NLM_F_CREATE should be set when creating new route [ 270.178510][ T9310] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 270.308882][ T392] plantronics 0003:047F:FFFF.002C: unknown main item tag 0x0 [ 270.316349][ T392] plantronics 0003:047F:FFFF.002C: unknown main item tag 0x0 [ 270.324377][ T392] plantronics 0003:047F:FFFF.002C: unknown main item tag 0x0 [ 270.331803][ T392] plantronics 0003:047F:FFFF.002C: unknown main item tag 0x0 [ 270.339811][ T392] plantronics 0003:047F:FFFF.002C: unknown main item tag 0x0 [ 270.348329][ T392] plantronics 0003:047F:FFFF.002C: No inputs registered, leaving [ 270.362720][ T392] plantronics 0003:047F:FFFF.002C: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 270.573359][ T10] usb 9-1: USB disconnect, device number 23 [ 270.671256][ T9336] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 270.671284][ T9336] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 270.703728][ T9336] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:64 [ 270.729805][ T9336] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 270.750422][ T9336] rust_binder: Read failure Err(EFAULT) in pid:64 [ 271.552489][ T9382] overlayfs: unescaped trailing colons in lowerdir mount option. [ 271.696251][ T9397] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EINVAL } [ 271.696283][ T9397] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EINVAL } my_pid:518 [ 271.796247][ T9405] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 271.805488][ T9405] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 271.809940][ T10] usb 7-1: new high-speed USB device number 59 using dummy_hcd [ 271.815113][ T9405] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:522 [ 271.830440][ T9405] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 271.839645][ T9405] rust_binder: Read failure Err(EFAULT) in pid:522 [ 271.973392][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 272.014675][ T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 272.026900][ T10] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 272.040137][ T10] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 272.054155][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.065587][ T10] usb 7-1: config 0 descriptor?? [ 272.129331][ T9423] rust_binder: Write failure EFAULT in pid:534 [ 272.211047][ T9427] overlayfs: failed to resolve './file0': -2 [ 272.268337][ T9431] binder: Unknown parameter '0xffffffffffffffff' [ 272.480885][ T10] plantronics 0003:047F:FFFF.002D: unknown main item tag 0x0 [ 272.500441][ T10] plantronics 0003:047F:FFFF.002D: unknown main item tag 0x0 [ 272.507881][ T10] plantronics 0003:047F:FFFF.002D: unknown main item tag 0x0 [ 272.531890][ T10] plantronics 0003:047F:FFFF.002D: unknown main item tag 0x0 [ 272.539371][ T10] plantronics 0003:047F:FFFF.002D: unknown main item tag 0x0 [ 272.548502][ T10] plantronics 0003:047F:FFFF.002D: No inputs registered, leaving [ 272.572701][ T10] plantronics 0003:047F:FFFF.002D: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 272.740610][ T392] usb 7-1: USB disconnect, device number 59 [ 272.809618][ T9456] 9pnet_fd: Insufficient options for proto=fd [ 272.836090][ T9456] erofs: (device erofs): erofs_read_superblock: cannot find valid erofs superblock [ 272.880899][ T9459] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 272.884343][ T9459] rust_binder: Error in use_page_slow: ESRCH [ 272.894604][ T9459] rust_binder: use_range failure ESRCH [ 272.900702][ T9459] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false [ 272.906170][ T9459] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } [ 272.914250][ T9459] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1270 [ 272.980888][ T9464] rust_binder: Write failure EFAULT in pid:551 [ 273.275576][ T9477] netlink: 188 bytes leftover after parsing attributes in process `syz.6.3689'. [ 273.481653][ T9485] loop7: detected capacity change from 0 to 7 [ 273.628048][ T36] kauditd_printk_skb: 777 callbacks suppressed [ 273.628066][ T36] audit: type=1400 audit(1756941213.179:27134): avc: denied { read write } for pid=7125 comm="syz-executor" name="loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 273.658335][ C0] blk_print_req_error: 34 callbacks suppressed [ 273.658355][ C0] invalid error, dev loop7, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 273.674318][ C0] buffer_io_error: 34 callbacks suppressed [ 273.674336][ C0] Buffer I/O error on dev loop7, logical block 0, lost async page write [ 273.704358][ T36] audit: type=1400 audit(1756941213.209:27135): avc: denied { read write open } for pid=7125 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 273.729913][ T36] audit: type=1400 audit(1756941213.209:27136): avc: denied { ioctl } for pid=7125 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 273.755585][ T36] audit: type=1400 audit(1756941213.249:27137): avc: denied { read write } for pid=4271 comm="syz-executor" name="loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 273.787170][ T36] audit: type=1400 audit(1756941213.249:27138): avc: denied { read write open } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 273.813116][ T36] audit: type=1400 audit(1756941213.249:27139): avc: denied { ioctl } for pid=4271 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=50 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 273.832456][ T9502] overlayfs: unescaped trailing colons in lowerdir mount option. [ 273.838755][ T36] audit: type=1400 audit(1756941213.259:27140): avc: denied { read write } for pid=9493 comm="syz.8.3695" name="binder1" dev="binder" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 273.869721][ T36] audit: type=1400 audit(1756941213.259:27141): avc: denied { read write open } for pid=9493 comm="syz.8.3695" path="/dev/binderfs/binder1" dev="binder" ino=20 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 273.894763][ T36] audit: type=1400 audit(1756941213.259:27142): avc: denied { ioctl } for pid=9493 comm="syz.8.3695" path="/dev/binderfs/binder1" dev="binder" ino=20 ioctlcmd=0x620d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 273.949807][ T36] audit: type=1400 audit(1756941213.259:27143): avc: denied { set_context_mgr } for pid=9493 comm="syz.8.3695" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 274.119929][ T392] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 274.148396][ T9515] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3700'. [ 274.276780][ T392] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 274.288205][ T392] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 274.298922][ T392] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 274.324847][ T392] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 274.343052][ T392] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 274.354301][ T392] usb 9-1: config 0 descriptor?? [ 274.385174][ T9521] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 274.385201][ T9521] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 274.396392][ T9521] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:104 [ 274.410187][ T9521] rust_binder: Failure when writing BR_NOOP at beginning of buffer. [ 274.427676][ T9521] rust_binder: Read failure Err(EFAULT) in pid:104 [ 274.496235][ T9525] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 274.631354][ T9523] rust_binder: 569: no such ref 2 [ 274.766500][ T392] plantronics 0003:047F:FFFF.002E: unknown main item tag 0x0 [ 274.774046][ T392] plantronics 0003:047F:FFFF.002E: unknown main item tag 0x0 [ 274.786438][ T392] plantronics 0003:047F:FFFF.002E: unknown main item tag 0x0 [ 274.793926][ T392] plantronics 0003:047F:FFFF.002E: unknown main item tag 0x0 [ 274.801555][ T392] plantronics 0003:047F:FFFF.002E: unknown main item tag 0x0 [ 274.809170][ T392] plantronics 0003:047F:FFFF.002E: No inputs registered, leaving [ 274.820319][ T392] plantronics 0003:047F:FFFF.002E: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 274.923426][ T9534] overlayfs: failed to resolve './file1': -2 [ 274.967164][ T9536] netlink: 37 bytes leftover after parsing attributes in process `syz.7.3709'. [ 275.030838][ T424] usb 9-1: USB disconnect, device number 24 [ 275.499029][ T9548] rust_binder: Error while translating object. [ 275.499065][ T9548] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } [ 275.506268][ T9548] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:584 [ 275.579961][ T10] usb 7-1: new high-speed USB device number 60 using dummy_hcd [ 275.752036][ T10] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 275.752411][ T9556] overlayfs: failed to resolve './file1': -2 [ 275.772680][ T10] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 275.797318][ T10] usb 7-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 275.809083][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 275.847948][ T10] usb 7-1: SerialNumber: syz [ 275.933734][ T9564] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 276.020228][ T9568] fuse: Invalid rootmode [ 276.064542][ T10] usb 7-1: cannot find UAC_HEADER [ 276.076828][ T10] snd-usb-audio 7-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 276.086563][ T10] usb 7-1: USB disconnect, device number 60 [ 276.099809][ T9] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 276.165716][ T4863] udevd[4863]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card0/controlC0/../uevent} for writing: No such file or directory [ 276.261729][ T9] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 276.272722][ T9] usb 9-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 276.281813][ T9] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.290977][ T9] usb 9-1: config 0 descriptor?? [ 276.379807][ T331] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 276.541767][ T331] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 276.552746][ T331] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 276.562496][ T331] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 276.575447][ T331] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 276.585632][ T331] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 276.595999][ T331] usb 2-1: config 0 descriptor?? [ 276.655805][ T9574] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 276.655831][ T9574] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 276.663862][ T9574] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:111 [ 276.702876][ T9] keytouch 0003:0926:3333.002F: fixing up Keytouch IEC report descriptor [ 276.744729][ T9577] overlayfs: failed to resolve './file1': -2 [ 276.752490][ T9] input: HID 0926:3333 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/0003:0926:3333.002F/input/input30 [ 276.808592][ T9579] rust_binder: Error while translating object. [ 276.808637][ T9579] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EBADF } [ 276.820625][ T9579] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EBADF } my_pid:115 [ 276.858678][ T9] keytouch 0003:0926:3333.002F: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.8-1/input0 [ 277.023687][ T331] plantronics 0003:047F:FFFF.0030: unknown main item tag 0x0 [ 277.056421][ T331] plantronics 0003:047F:FFFF.0030: unknown main item tag 0x0 [ 277.069849][ T331] plantronics 0003:047F:FFFF.0030: unknown main item tag 0x0 [ 277.077303][ T331] plantronics 0003:047F:FFFF.0030: unknown main item tag 0x0 [ 277.096648][ T331] plantronics 0003:047F:FFFF.0030: unknown main item tag 0x0 [ 277.106484][ T331] plantronics 0003:047F:FFFF.0030: No inputs registered, leaving [ 277.161117][ T331] plantronics 0003:047F:FFFF.0030: hiddev96,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 277.259294][ T331] usb 9-1: USB disconnect, device number 25 [ 277.302285][ T424] usb 2-1: USB disconnect, device number 52 [ 277.429882][ T9592] fido_id[9592]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 277.916084][ C0] invalid error, dev loop7, sector 0 op 0x1:(WRITE) flags 0x800 phys_seg 1 prio class 0 [ 277.925903][ C0] Buffer I/O error on dev loop7, logical block 0, lost async page write [ 278.024640][ T9612] rust_binder: Error while translating object. [ 278.024676][ T9612] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOENT } Stopping sshd: [ 278.047216][ T9612] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOENT } my_pid:564 [ 278.286395][ T9635] rust_binder: BINDER_SET_CONTEXT_MGR already set stopped /usr/sbin/sshd (pid 200) [ 278.299399][ T9635] rust_binder: Error in use_page_slow: ESRCH [ 278.309341][ T9635] rust_binder: use_range failure ESRCH [ 278.316394][ T9635] rust_binder: Failed to allocate buffer. len:4248, is_oneway:false OK [ 278.322463][ T9635] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ESRCH } Stopping crond: stopped /usr/sbin/crond (pid 193) OK [ 278.351236][ T9635] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ESRCH } my_pid:1311 [ 278.630484][ T36] kauditd_printk_skb: 600 callbacks suppressed [ 278.630503][ T36] audit: type=1400 audit(1756941218.189:27744): avc: denied { read write } for pid=6534 comm="syz-executor" name="loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 Stopping dhcpcd... [ 278.739815][ T392] usb 9-1: new high-speed USB device number 26 using dummy_hcd [ 278.757123][ T36] audit: type=1400 audit(1756941218.189:27745): avc: denied { read write open } for pid=6534 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=56 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 stopped /sbin/dhcpcd (pid 147) [ 278.834241][ T36] audit: type=1400 audit(1756941218.189:27746): avc: denied { ioctl } for pid=6534 comm="syz-executor" path="/dev/loop7" dev="devtmpfs" ino=56 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 278.901888][ T392] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 278.929811][ T392] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 278.949710][ T392] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 278.972781][ T392] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 278.979120][ T36] audit: type=1400 audit(1756941218.239:27747): avc: denied { ioctl } for pid=9642 comm="syz.8.3749" path="/dev/raw-gadget" dev="devtmpfs" ino=190 ioctlcmd=0x5502 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 278.995377][ T392] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.087282][ T392] usb 9-1: config 0 descriptor?? [ 279.099801][ T36] audit: type=1400 audit(1756941218.279:27748): avc: denied { read write } for pid=9117 comm="syz-executor" name="loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 Stopping network: [ 279.211171][ T36] audit: type=1400 audit(1756941218.279:27749): avc: denied { read write open } for pid=9117 comm="syz-executor" path="/dev/loop6" dev="devtmpfs" ino=55 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 279.213434][ T4271] audit: audit_backlog=65 > audit_backlog_limit=64 [ 279.250322][ T9664] audit: audit_backlog=65 > audit_backlog_limit=64 [ 279.256854][ T9664] audit: audit_lost=21 audit_rate_limit=0 audit_backlog_limit=64 [ 279.269830][ T4271] audit: audit_lost=22 audit_rate_limit=0 audit_backlog_limit=64 [ 279.518734][ T392] plantronics 0003:047F:FFFF.0031: unknown main item tag 0x0 [ 279.526272][ T392] plantronics 0003:047F:FFFF.0031: unknown main item tag 0x0 [ 279.564476][ T392] plantronics 0003:047F:FFFF.0031: unknown main item tag 0x0 [ 279.599054][ T392] plantronics 0003:047F:FFFF.0031: unknown main item tag 0x0 [ 279.639809][ T392] plantronics 0003:047F:FFFF.0031: unknown main item tag 0x0 [ 279.667632][ T392] plantronics 0003:047F:FFFF.0031: No inputs registered, leaving [ 279.711698][ T392] plantronics 0003:047F:FFFF.0031: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 279.789832][ T392] usb 9-1: USB disconnect, device number 26 [ 279.927779][ T9689] fido_id[9689]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory OK Stopping iptables: OK Stopping system message bus: [ 280.720479][ T9732] netlink: 188 bytes leftover after parsing attributes in process `syz.1.3772'. [ 280.839818][ T9739] rust_binder: BINDER_SET_CONTEXT_MGR already set [ 280.842670][ T9739] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 280.849130][ T9739] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 280.889809][ T9739] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:1350 [ 281.249832][ T392] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 281.441928][ T392] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 281.453462][ T392] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 281.463332][ T392] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 281.479858][ T392] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 281.489207][ T392] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 281.510147][ T392] usb 2-1: config 0 descriptor?? done [ 281.871976][ T9766] sit0: entered promiscuous mode [ 281.890504][ T9766] netlink: 'syz.6.3784': attribute type 1 has an invalid length. [ 281.898274][ T9766] netlink: 'syz.6.3784': attribute type 3 has an invalid length. [ 281.930917][ T392] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 281.938354][ T392] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 281.947727][ T392] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 281.955749][ T392] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 281.963790][ T392] plantronics 0003:047F:FFFF.0032: unknown main item tag 0x0 [ 281.972943][ T392] plantronics 0003:047F:FFFF.0032: No inputs registered, leaving [ 281.986395][ T9768] rust_binder: Error while translating object. [ 281.986444][ T9768] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: EPERM } [ 281.993260][ T9768] rust_binder: Transaction failed: BR_FAILED_REPLY { source: EPERM } my_pid:177 [ 282.004567][ T392] plantronics 0003:047F:FFFF.0032: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 282.183415][ T331] usb 2-1: USB disconnect, device number 53 [ 282.218132][ T392] rust_binder: 9765: removing orphan mapping 0:24 [ 282.439895][ T10] usb 9-1: new high-speed USB device number 27 using dummy_hcd [ 282.513513][ T9778] overlayfs: only single ':' or double '::' sequences of unescaped colons in lowerdir mount option allowed. Stopping klogd: [ 282.599817][ T10] usb 9-1: Using ep0 maxpacket: 32 OK [ 282.619950][ T10] usb 9-1: config index 0 descriptor too short (expected 29220, got 36) [ 282.628310][ T10] usb 9-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 282.637263][ T10] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 282.646258][ T10] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 282.655928][ T10] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 Stopping acpid: [ 282.665589][ T10] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 282.679985][ T10] usb 9-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 282.689158][ T10] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 282.701333][ T10] usb 9-1: config 0 descriptor?? [ 282.913316][ T10] usblp 9-1:0.0: usblp0: USB Bidirectional printer dev 27 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 282.925288][ T10] usb 9-1: USB disconnect, device number 27 [ 282.932881][ T10] usblp0: removed [ 283.144620][ T9795] rust_binder: Failed to allocate buffer. len:4120, is_oneway:true [ 283.144646][ T9795] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 283.152630][ T9795] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:188 [ 283.196777][ T9799] netlink: 37 bytes leftover after parsing attributes in process `syz.6.3793'. [ 283.434974][ T9816] overlayfs: failed to resolve './file0': -2 [ 283.639797][ T36] kauditd_printk_skb: 610 callbacks suppressed [ 283.639815][ T36] audit: type=1400 audit(1756941223.179:28316): avc: denied { read write } for pid=7125 comm="syz-executor" name="loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 283.673787][ T36] audit: type=1400 audit(1756941223.189:28317): avc: denied { read write open } for pid=7125 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 283.699903][ T36] audit: type=1400 audit(1756941223.189:28318): avc: denied { ioctl } for pid=7125 comm="syz-executor" path="/dev/loop8" dev="devtmpfs" ino=57 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 283.725961][ T36] audit: type=1400 audit(1756941223.199:28319): avc: denied { read } for pid=9821 comm="syz.7.3802" dev="nsfs" ino=4026532432 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 283.747824][ T36] audit: type=1400 audit(1756941223.199:28320): avc: denied { read open } for pid=9821 comm="syz.7.3802" path="net:[4026532432]" dev="nsfs" ino=4026532432 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 283.771668][ T36] audit: type=1400 audit(1756941223.199:28321): avc: denied { create } for pid=9821 comm="syz.7.3802" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 OK [ 283.805898][ T36] audit: type=1400 audit(1756941223.199:28322): avc: denied { getopt } for pid=9821 comm="syz.7.3802" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 283.845510][ T36] audit: type=1400 audit(1756941223.199:28323): avc: denied { setopt } for pid=9821 comm="syz.7.3802" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 283.874008][ T36] audit: type=1400 audit(1756941223.199:28324): avc: denied { create } for pid=9821 comm="syz.7.3802" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 283.895383][ T36] audit: type=1400 audit(1756941223.199:28325): avc: denied { setopt } for pid=9821 comm="syz.7.3802" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 Stopping syslogd: [ 284.000680][ T9840] overlayfs: failed to resolve './file0': -2 stopped /sbin/syslogd (pid 91) OK [ 284.159044][ T9854] rust_binder: Failed to allocate buffer. len:4248, is_oneway:true [ 284.159070][ T9854] rust_binder: Failure in copy_transaction_data: BR_FAILED_REPLY { source: ENOSPC } [ 284.167104][ T9854] rust_binder: Transaction failed: BR_FAILED_REPLY { source: ENOSPC } my_pid:630 umount: can't remount debugfs read-only umount: can't remount sysfs read-only umount: can't remount devtmpfs read-only umount: can't remount /dev/root read-only The system is going down NOW! [ 284.367588][ T331] usb 2-1: new high-speed USB device number 54 using dummy_hcd Connection to 10.128.0.112 closed by remote host. Sent SIGTERM to all processes [ 284.582649][ T1493] bridge_slave_1: left allmulticast mode [ 284.588318][ T1493] bridge_slave_1: left promiscuous mode [ 284.593968][ T1493] bridge0: port 2(bridge_slave_1) entered disabled state [ 284.601673][ T1493] bridge_slave_0: left allmulticast mode [ 284.607313][ T1493] bridge_slave_0: left promiscuous mode [ 284.612999][ T1493] bridge0: port 1(bridge_slave_0) entered disabled state [ 284.760871][ T1493] tipc: Left network mode [ 284.766107][ T1493] veth1_macvtap: left promiscuous mode [ 284.771636][ T1493] veth0_vlan: left promiscuous mode [ 284.980736][ T1493] bridge_slave_1: left allmulticast mode [ 284.986394][ T1493] bridge_slave_1: left promiscuous mode [ 284.992051][ T1493] bridge0: port 2(bridge_slave_1) entered disabled state [ 284.999414][ T1493] bridge_slave_0: left allmulticast mode [ 285.005168][ T1493] bridge_slave_0: left promiscuous mode [ 285.010787][ T1493] bridge0: port 1(bridge_slave_0) entered disabled state [ 285.018258][ T1493] bridge_slave_1: left allmulticast mode [ 285.023959][ T1493] bridge_slave_1: left promiscuous mode [ 285.029537][ T1493] bridge0: port 2(bridge_slave_1) entered disabled state [ 285.036850][ T1493] bridge_slave_0: left allmulticast mode [ 285.042547][ T1493] bridge_slave_0: left promiscuous mode [ 285.048103][ T1493] bridge0: port 1(bridge_slave_0) entered disabled state [ 285.251422][ T1493] tipc: Left network mode [ 285.256741][ T1493] veth1_macvtap: left promiscuous mode [ 285.262278][ T1493] veth0_vlan: left promiscuous mode [ 285.267648][ T1493] veth1_macvtap: left promiscuous mode [ 285.273187][ T1493] veth0_vlan: left promiscuous mode Sent SIGKILL to all processes Requesting system poweroff [ 286.522535][ T9865] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 286.529309][ T9865] ACPI: PM: Preparing to enter system sleep state S5 [ 286.536188][ T9865] kvm: exiting hardware virtualization [ 286.541736][ T9865] reboot: Power down serialport: VM disconnected.